PT-2018-1374 · Nvidia+1 · Nvidia Trusted Execution Environment+1

Published 2018-05-01 · Updated 2019-10-03 · CVE-2017-6289

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to the 2018-05-05 security patch level

Description The issue is related to a memory corruption vulnerability in the NVIDIA Trusted Execution Environment (TEE) component of the Android operating system. This vulnerability may lead to local escalation of privileges if exploited within the speculative execution of the TEE. The issue is rated as critical.

Recommendations For Android versions prior to the 2018-05-05 security patch level, update to a version that includes the 2018-05-05 security patch level or later to resolve the issue. As a temporary workaround, consider restricting access to the TEE component to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-264

CWE-119

Related Identifiers

BDU:2018-00918

CVE-2017-6289

Affected Products

Android

Nvidia Trusted Execution Environment

References · 4

• https://bdu.fstec.ru/vul/2018-00918 · Security Note
• https://source.android.com/security/bulletin/2018-05-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6289 · Security Note
• http://securityfocus.com/bid/104145 · Note