LiveActive security incident?Get immediate response
CVE Record

CVE-2021-34373: Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap ha...

Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead to information disclosure and denial of service.

HighCVSS 7.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-34373 affects NVIDIA Jetson TX1 systems running Jetson Linux before r32.5.1. A weakness in NVIDIA’s Trusty trusted Linux kernel could allow heap overflows, potentially exposing sensitive information or causing denial of service. The issue requires local access with high privileges, reducing likelihood but not impact.

Executive priority

Treat as high priority for Jetson TX1 fleets, especially operational edge systems. The privileges required reduce broad exploitability, but successful abuse could expose sensitive data or disrupt device availability.

Technical view

The vulnerability is in the NVIDIA TLK kernel within Trusty trusted Linux kernel on Jetson TX1. Lack of heap hardening may allow heap overflows. CVSS 3.1 is 7.9: local attack vector, low complexity, high privileges required, no user interaction, changed scope, high confidentiality and availability impact.

Likely exposure

Exposure appears limited to NVIDIA Jetson TX1 devices on Jetson Linux releases earlier than r32.5.1. Systems already on r32.5.1 or later are not identified as affected in the source bundle.

Exploitation context

No CISA KEV listing or provided source indicates active exploitation. Exploitation requires local access and high privileges, so this is more concerning on shared, compromised, or physically accessible Jetson deployments than remotely exposed services.

Researcher notes

Public details are sparse. The evidence supports heap-overflow risk from missing heap hardening in NVIDIA TLK, but does not provide exploit mechanics, indicators, or compensating controls beyond upgrading or following NVIDIA guidance.

Mitigation direction

  • Upgrade affected Jetson TX1 systems to Jetson Linux r32.5.1 or later.
  • Review NVIDIA advisory 5205 for vendor-specific remediation guidance.
  • Restrict local administrative access to Jetson devices until updated.
  • Prioritize devices in production, edge, or physically accessible environments.

Validation and detection

  • Inventory Jetson TX1 devices and record installed Jetson Linux releases.
  • Compare each release against the r32.5.1 fixed-version threshold.
  • Confirm whether any affected systems run in shared or untrusted local-access environments.
  • Track remediation status against NVIDIA advisory 5205.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-34373 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.9CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H1.55.8Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.9High
CVSS 3.1 vector shape for CVE-2021-34373Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NVIDIANVIDIA Jetson TX1All Jetson Linux versions prior to r32.5.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.