CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
100.0%
NVIDIA SHIELD Tablet Response to CPU Speculative Side Channel Vulnerabilities - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 Go to NVIDIA Product Security.
NVIDIA is providing an initial security update to mitigate aspects of Google Project Zero’s January 3, 2018, publication of novel information disclosure attacks that combine CPU speculative execution with known side channels.
NVIDIA believes SHIELD Tablet GPU hardware is immune to the reported security issue. SHIELD Tablet integrates an Arm (CPU) processor that may, in certain circumstances, benefit from software mitigations to reduce the risk of the exploits identified in the Google Project Zero disclosure. For more information, refer to the Arm Security Update.
This bulletin addresses NVIDIA software updates for SHIELD Tablet to mitigate aspects of the potential Arm CPU vulnerabilities.
These potential vulnerabilities have three known variants:
Variant 1 (CVE-2017-5753): Software mitigations for the Arm CPU issue are provided with the security update included in this bulletin. NVIDIA expects to work together with its ecosystem partners as future updates are released to further strengthen mitigations for the potentially affected CPU.
Variant 2 (CVE-2017-5715): Software mitigations for the Arm CPU issue are provided with the security update included in this bulletin. NVIDIA expects to work together with its ecosystem partners as future updates are released to further strengthen mitigations for the potentially affected CPU.
Variant 3 (CVE-2017-5754): NVIDIA believes that SHIELD Tablet is not vulnerable to this variant.
Variant 3a (CVE-2017-5754): Based on Arm’s Security Update, NVIDIA believes that SHIELD Tablet does not need software mitigations for this variant.
For updates and additional information, actively monitor the NVIDIA Product Security page.
The following sections summarize the potential vulnerabilities. Descriptions are as published on MITRE and risk assessments follow CVSS.
Computer systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis.
CVSS Base Score: 8.2 CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Computer systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis.
CVSS Base Score: 8.2 CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Computer systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis of the data cache.
CVSS Base Score: 7.9 CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
NVIDIA’s risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk of your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk of your specific configuration. NVIDIA doesn’t know of any exploits to these issues at this time.
Product | Integrated CPU | OS |
---|---|---|
SHIELD Tablet Software | Arm Cortex-A15 processor | Android |
Updates for SHIELD are available from Settings >About>System update.
Product | Updated Version |
---|---|
SHIELD Tablet | SHIELD Experience 5.4 |
Note: If you are using earlier driver branches of the affected products, upgrade to one of the updated supported versions listed.
None.
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
100.0%