IGX Orin: Unimplemented or Unsupported Feature in UI
CVE-2024-0148 is a high-severity unimplemented or unsupported feature in UI vulnerability in IGX Orin from NVIDIA, with a CVSS 3.1 base score of 7.6 out of 10. It can be exploited with physical access to the device by an unauthenticated attacker, without any action from a user. Affected IGX Orin versions: All versions prior to IGX 1.1. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of IGX Orin you run against the affected versions below, and install the vendor's latest release.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| NVIDIA | IGX Orin | All versions prior to IGX 1.1 | Not stated |
| NVIDIA | Jetson AGX Orin Series | All versions prior to 36.4.3 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- PhysicalThe attacker must physically touch the device.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by CNA (nvidia.com).
Official description
NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Unimplemented or Unsupported Feature in UI
A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.
How developers prevent this class of flaw
- Perform functionality testing before deploying the application.
More Unimplemented or Unsupported Feature in UI vulnerabilities (CWE-447)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in IGX Orin
- 7.5 High severity
Spotted an error? Tell us.