PT-2015-3793 · Nvidia · Nvidia Tegra Linux Kernel

Published 2015-02-06 · Updated 2016-09-20 · CVE-2014-5332

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA Tegra Linux Kernel version 3.10

Description A race condition exists in the NVMap component of the NVIDIA Tegra Linux Kernel, allowing local users to gain privileges. This is achieved through a crafted NVMAP IOC CREATE IOCTL call, which triggers a use-after-free error. The issue can be exploited to escape the Chrome sandbox.

Recommendations For NVIDIA Tegra Linux Kernel version 3.10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2014-5332

Affected Products

Nvidia Tegra Linux Kernel

References · 6

• 🔥 http://googleprojectzero.blogspot.com/2015/01/exploiting-nvmap-to-escape-chrome.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5332 · Security Note
• https://ubuntu.com/security/CVE-2014-5332 · Vendor Advisory
• http://nvidia.custhelp.com/app/answers/detail/a_id/3618 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5332 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5332 · Security Note