CVE-2021-34389

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
NVIDIANVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavier NXAll Jetson Linux versions prior to r32.5.1

References

Timeline

Published
Jun 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-34397.8HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate tCVE-2021-343905.5Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow throCVE-2021-343915.5Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow throCVE-2021-343925.5Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundaryCVE-2021-343934.4Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. ThiCVE-2021-343946.7Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows anCVE-2021-343954.2Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user wCVE-2021-343962.3Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, whicCVE-2021-343972.3Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service.CVE-2021-343987.8NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCCVE-2021-343994.4NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gaiCVE-2021-34407.8HP Print and Scan Doctor, an application within the HP Smart App for Windows, is potentially vulnerable to local elevation of privilege.
CVE-2021-34389: Medium severity, CVSS 5.0 | Vulnix