What is the CVSS score of CVE-2021-23217?

CVE-2021-23217 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Jetson Tx1 CVE-2021-23217

HIGH

2021-11-20 psirt@nvidia.com

RCE Nvidia Jetson Tx1 Geforce Gt 605 Geforce Gt 610 Geforce Gt 620 Geforce Gt 625 Geforce Gt 630 Geforce Gt 635 Geforce Gt 640 Geforce Gt 705 Geforce Gt 710 Geforce Gt 720 Geforce Gt 730 Geforce Gt 740 Geforce Gtx 645 Geforce Gtx 650 Geforce Gtx 650 Ti Geforce Gtx 650 Ti Boost Geforce Gtx 660 Geforce Gtx 660 Ti Geforce Gtx 670 Geforce Gtx 680 Geforce Gtx 690 Geforce Gtx 745 Geforce Gtx 750 Geforce Gtx 750 Ti Geforce Gtx 760 Geforce Gtx 760 Ti Geforce Gtx 770 Geforce Gtx 780 Geforce Gtx 780 Ti Geforce Gtx 950 Geforce Gtx 960 Geforce Gtx 970 Geforce Gtx 980 Geforce Gtx Titan X Gtx Titan Gtx Titan Black Gtx Titan Z Jetson Nano Quadro M1000M Quadro M1200 Quadro M2000 Quadro M2000M Quadro M2200 Quadro M3000M Quadro M4000 Quadro M4000M Quadro M5000 Quadro M5000M Quadro M500M Quadro M520 Quadro M5500 Quadro M6000 Quadro M600M Quadro M620 Shield Tv Shield Tv Pro Tesla M10 Tesla M4 Tesla M40 Tesla M6 Tesla M60 Tesla P100

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Impact	CVSS score of 7.5 (HIGH). Attack characteristics: local attack vector, high complexity, high privileges required, no user interaction not required.
Exploit ScenarioDerived	Successful exploitation could compromise the high-severity affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or availability. The scope impact may extend to other components. Affected products include: Nvidia Geforce Gt 605, Nvidia Geforce Gt 610, Nvidia Geforce Gt 620, Nvidia Geforce Gt 625, Nvidia Geforce Gt 630.

Know when Jetson Tx1 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)NVD

cpe:2.3:h:nvidia:geforce_gt_605:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_610:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_620:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_625:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_630:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_635:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_640:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_705:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_710:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_720:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_730:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gt_740:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_645:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_650:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_650_ti:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_650_ti_boost:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_660:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_660_ti:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_670:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:geforce_gtx_680:-:*:*:*:*:*:*:*

+ 45 more

More in Jetson Tx1

View all

CVE-2018-3639 MEDIUM This Month POC

5.5 May 22

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres

CVE-2017-1000251 HIGH This Week POC

8.0 Sep 12

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ

CVE-2019-5672 CRITICAL Act Now

9.1 Apr 11

NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior t

CVE-2021-23201 HIGH This Week

7.5 Nov 20

NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevat

CVE-2021-34400 MEDIUM This Month

4.4 Nov 20