LiveActive security incident?Get immediate response
CVE Record

CVE-2021-34372: Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA...

Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc() size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of privileges, and denial of service.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-34372 affects NVIDIA Jetson devices using older Jetson Linux releases. A flaw in Trusty, NVIDIA’s trusted OS, can cause memory corruption and may allow data exposure, privilege escalation, or denial of service. The issue matters most for deployed Jetson edge systems that run local workloads or accept interaction from less-trusted users.

Executive priority

Treat as high priority for Jetson fleets, especially production edge deployments. The attack is not described as remote, but the affected component is security-sensitive and the potential business impact includes compromise of data, device control, and uptime.

Technical view

The vulnerability is an integer overflow in NVIDIA OTE protocol message parsing inside the Trusty driver. The overflow affects a malloc() size calculation and can lead to a heap buffer overflow. NVIDIA lists Jetson TX2 series, TX2 NX, AGX Xavier series, and Xavier NX running Jetson Linux before r32.5.1 as affected.

Likely exposure

Exposure is limited to listed NVIDIA Jetson platforms running Jetson Linux versions earlier than r32.5.1. The CVSS vector indicates local access, low privileges, and user interaction are required, so internet-facing exposure is not implied by the sources.

Exploitation context

The provided sources do not identify active exploitation, and this CVE is not flagged as CISA KEV. Risk remains significant because successful exploitation may affect confidentiality, integrity, and availability in a trusted OS component.

Researcher notes

Validation should focus on affected hardware, Jetson Linux release level, and local trust boundaries. The source evidence supports memory corruption through integer overflow during OTE protocol message parsing, but does not provide exploit maturity, public exploit evidence, or detailed workaround information.

Mitigation direction

  • Upgrade affected Jetson systems to Jetson Linux r32.5.1 or a supported later release.
  • Check NVIDIA advisory guidance for model-specific update instructions.
  • Restrict local access to Jetson devices until updates are confirmed.
  • Limit untrusted workloads and user interaction on affected devices.
  • Prioritize edge systems handling sensitive data or operational control tasks.

Validation and detection

  • Inventory Jetson TX2, TX2 NX, AGX Xavier, and Xavier NX deployments.
  • Confirm each device’s Jetson Linux release is r32.5.1 or later.
  • Map whether local users or applications can interact with affected devices.
  • Verify update completion through asset records or device management data.
  • Review logs for unexplained crashes on affected pre-update systems.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-34372 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H1.56Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2021-34372Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NVIDIANVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier NXAll Jetson Linux versions prior to r32.5.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.