First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2021-34386

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation can cause the multiplication of count and size can overflow, which might lead to heap overflows.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
NVIDIA	NVIDIA Jetson TX1	All Jetson Linux versions prior to r32.5.1

References

Timeline

Published: Jun 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-343876.7The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRA CVE-2021-343887.8Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to control all the RAM after CVE-2021-343895.0Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can CVE-2021-34397.8HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate t CVE-2021-343905.5Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow thro CVE-2021-343915.5Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow thro CVE-2021-343925.5Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary CVE-2021-343934.4Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. Thi CVE-2021-343946.7Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an CVE-2021-343954.2Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user w CVE-2021-343962.3Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, whic CVE-2021-343972.3Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service.

CVE-2021-34386: Medium severity, CVSS 6.7 | Vulnix