4.6
CVSSv2

CVE-2019-5680

Published: 19/07/2019 Updated: 24/07/2019
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 6.7 | Impact Score: 5.9 | Exploitability Score: 0.8
VMScore: 409
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu image is loaded without the load address first being validated, which may lead to code execution, denial of service, or escalation of privileges.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

nvidia jetson_tx1_firmware

Github Repositories

CVE‑2019‑5680

Selfblow exploit, when nvtboot blows a hole in itself This is an untethered coldboot exploit and as far as i can tell it affects every single Tegra device released so far (Except the Nintendo Switch since it uses a custom bootloader) Completely defeats secure boot even on latest firmware TL;DR: nvtboot (NVC) loads nvtboot-cpu (TBC) without validating the load address first,

Recent Articles

Palo Alto gateway security alert, FSB hack, scourge of data-stealing web plugins, and more
The Register • Shaun Nichols in San Francisco • 21 Jul 2019

A summary of computer security news for you, delivered rapid-fire-style

Roundup Let's catch up with all the recent infosec news beyond what we've already covered. If you're using Palo Alto Network's GlobalProtect Portal or Gateway, ensure you're using the latest version of the software. The biz quietly issued a maintenance update to close a security hole – a trivial string formatting vulnerability no less – that can be potentially exploited by miscreants to hijack installations of the code over the network or internet. This is a pre-authentication remote-code ex...