NVIDIA Shield Experience vulnerabilities

17 CVEs affecting NVIDIA Shield Experience, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34406, published 2022-01-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-5700, published 2019-10-09. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate the fields of the boot image, which may lead to code…
CVE-2019-5699, published 2019-10-09. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lead to buffer overflow resulting in…
CVE-2019-5681, published 2019-08-13. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system service where user data could be overridden, which may lead to code execution,…
CVE-2019-5682, published 2019-08-06. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the…
CVE-2019-5679, published 2019-08-06. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated, which may lead to code execution, denial…
CVE-2021-1067, published 2021-01-20. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block,…
CVE-2021-1068, published 2021-01-20. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary…
CVE-2021-1069, published 2021-01-20. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnormal reboot due to a null pointer reference, causing data loss.
CVE-2021-34403, published 2022-01-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to code privilege escalation, loss of…
CVE-2021-34401, published 2022-01-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial…

Latest

CVE-2021-34406, published 2022-01-18. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot.
CVE-2021-34405, published 2022-01-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointer dereference may lead to denial of service.
CVE-2021-34404, published 2022-01-18. High severity, CVSS 7.6. EPSS: 0.2% chance of exploitation in the next 30 days. Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged attacker with physical access to cause…
CVE-2021-34402, published 2022-01-18. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary…
CVE-2021-1108, published 2021-08-11. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity,…
CVE-2021-1107, published 2021-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVMAP_IOC_WRITE* paths, where improper access controls may lead to code execution, complete denial of service, and seriously…
CVE-2021-1106, published 2021-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA Linux kernel distributions contain a vulnerability in nvmap, where writes may be allowed to read-only buffers, which may result in escalation of privileges, complete denial of service,…