CVE-2022-42269 : NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure

NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cause information disclosure and compromise integrity. The scope of the impact can extend to other components.

Published 2022-12-30 23:15:12

Updated 2023-01-09 19:54:19

Source NVIDIA Corporation

View at NVD, CVE.org

Vulnerability category: Input validationInformation leak

Products affected by CVE-2022-42269

Nvidia » Jetson Linux
Versions before (<) 32.7.2
cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Jetson Agx Xavier » Version: N/A
When used together with: Nvidia » Jetson Agx Xavier 16gb » Version: N/A
When used together with: Nvidia » Jetson Agx Xavier 32gb » Version: N/A
When used together with: Nvidia » Jetson Agx Xavier 64gb » Version: N/A
When used together with: Nvidia » Jetson Agx Xavier 8gb » Version: N/A
When used together with: Nvidia » Jetson Agx Xavier Industrial » Version: N/A
When used together with: Nvidia » Jetson Tx1 » Version: N/A
When used together with: Nvidia » Jetson Tx2 » Version: N/A
When used together with: Nvidia » Jetson Tx2 4gb » Version: N/A
When used together with: Nvidia » Jetson Tx2 Nx » Version: N/A
When used together with: Nvidia » Jetson Tx2i » Version: N/A
When used together with: Nvidia » Jetson Xavier Nx » Version: N/A
When used together with: Nvidia » Jetson Xavier Nx 16gb » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-42269

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-42269

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.9	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N	1.5	5.8	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: None
7.9	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N	1.5	5.8	NVIDIA Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2022-42269

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- nvd@nist.gov (Primary)
- psirt@nvidia.com (Secondary)

References for CVE-2022-42269

https://nvidia.custhelp.com/app/answers/detail/a_id/5417

Security Bulletin: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson TX1, Jetson TX2 Series (including Jetson TX2 NX), and Jetson Nano (including Jetson Nano 2GB) - November 2022 | NVIDIA
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-42269

Products affected by CVE-2022-42269

Exploit prediction scoring system (EPSS) score for CVE-2022-42269

CVSS scores for CVE-2022-42269

CWE ids for CVE-2022-42269

References for CVE-2022-42269