LiveActive security incident?Get immediate response
CVE Record

CVE-2021-34392: Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared...

Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-34392 affects NVIDIA Jetson TX1 systems running Jetson Linux before r32.5.1. A flaw in NVIDIA’s trusted kernel code could let a low-privileged local condition bypass memory boundary checks and cause denial of service. The business risk is availability disruption on exposed Jetson TX1 devices, not data theft based on the provided sources.

Executive priority

Treat this as a targeted embedded-device availability risk. It is not currently evidenced as actively exploited, but affected Jetson TX1 devices in operational environments should be updated through normal maintenance or faster where downtime would matter.

Technical view

The vulnerability is an integer overflow in the Trusty TLK NVIDIA TLK kernel function tz_map_shared_mem. The overflow can bypass boundary checks and may cause denial of service. CVSS 3.1 is 4.4 with local access, high attack complexity, low privileges, user interaction required, unchanged scope, and high availability impact only.

Likely exposure

Exposure is limited to NVIDIA Jetson TX1 devices running Jetson Linux versions before r32.5.1. The source bundle does not identify other Jetson models, cloud services, or remote network exposure.

Exploitation context

The CVE is not listed as KEV in the supplied data, and no cited source states active exploitation. The CVSS vector indicates local access and high complexity, reducing broad exploitation likelihood while preserving denial-of-service concern for deployed devices.

Researcher notes

Evidence is concise: product scope is Jetson TX1 before Jetson Linux r32.5.1, impact is denial of service, and the vulnerable area is tz_map_shared_mem in NVIDIA TLK. No CWE, exploit details, or broader model impact are provided in the source bundle.

Mitigation direction

  • Upgrade affected Jetson TX1 systems to Jetson Linux r32.5.1 or later.
  • Review NVIDIA advisory 5205 for vendor-supported remediation details.
  • Prioritize systems supporting safety, production, or physical operations.
  • Limit local user access on affected devices until updated.
  • Track unsupported or unmanaged Jetson TX1 images separately.

Validation and detection

  • Inventory Jetson TX1 devices across production, lab, and embedded deployments.
  • Confirm each device runs Jetson Linux r32.5.1 or later.
  • Check golden images and provisioning pipelines for older Jetson Linux releases.
  • Verify operational owners have applied NVIDIA’s advisory guidance.
  • Document exceptions where update timing depends on device certification.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-34392 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H0.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-34392Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NVIDIANVIDIA Jetson TX1All Jetson Linux versions prior to r32.5.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.