Lucene search

NvidiaCVE-2020-5974

HistoryJul 08, 2020 - 11:15 p.m.

CVE-2020-5974

2020-07-0823:15:09

CWE-276

nvidia

web.nvd.nist.gov

nvidia

jetpack

sdk

vulnerability

installation scripts

privilege escalation

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

12.6%

JSON

NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.

Affected configurations

Nvd

Node

nvidiajetpack_software_development_kitMatch4.2

nvidiajetpack_software_development_kitMatch4.3

VendorProductVersionCPE
nvidiajetpack_software_development_kit4.2cpe:2.3:a:nvidia:jetpack_software_development_kit:4.2:*:*:*:*:*:*:*
nvidiajetpack_software_development_kit4.3cpe:2.3:a:nvidia:jetpack_software_development_kit:4.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nvidia	jetpack_software_development_kit	4.2	cpe:2.3:a:nvidia:jetpack_software_development_kit:4.2:::::::*
nvidia	jetpack_software_development_kit	4.3	cpe:2.3:a:nvidia:jetpack_software_development_kit:4.3:::::::*

CNA Affected

[
  {
    "product": "NVIDIA Jetson AGX Xavier, TX1, TX2, and Nano L4T",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "JetPack SDK 4.2, 4.3"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/5039

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2020-5974