CVE-2017-6289

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vulnerability, which if run within the speculative execution of the TEE, may lead to local escalation of privileges. This issue is rated as critical. Android: A-72830049. Reference: N-CVE-2017-6289.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Nvidia Corporation	Android	NA

References

http://www.securityfocus.com/bid/104145Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-05-01Vendor Advisory
http://www.securityfocus.com/bid/104145Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-05-01Vendor Advisory

Timeline

Published: May 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-62907.8In Android before the 2018-06-05 security patch level, NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overfl CVE-2017-62927.8In Android before the 2018-06-05 security patch level, NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow CVE-2017-62937.8In Android before the 2018-05-05 security patch level, NVIDIA Tegra X1 TZ contains a vulnerability in Widevine TA where the software writes CVE-2017-62947.8In Android before the 2018-06-05 security patch level, NVIDIA Tegra X1 TZ contains a possible out of bounds write due to missing bounds chec CVE-2017-62958.4NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the CVE-2017-62967.0NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of p CVE-2017-62975.9The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-mid CVE-2017-62987.8An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not CVE-2017-62995.5An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in the TNEFFillMapi func CVE-2017-63007.8An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef CVE-2017-63017.8An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."CVE-2017-63027.8An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow."