TI-2022-06190 Aliases CVE-2022-21819 GHSA-5q8q-7qqw-cmj3

Incorrect permission assignment in NVIDIA Jetson Nano, Jetson Nano 2GB

LOW 33CWE-732Published 2022-03-11 · Updated 2024-08-03

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service, code execution, escalation of privileges, and impact to data integrity and confidentiality. The scope impact may extend to other components.

Why it matters now

EPSS 0.00406 35th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NVIDIA	Jetson Nano, Jetson Nano 2GB	All 32.x versions prior to 32.7.1	—	No fix listed	CNA

Jetson Nano, Jetson Nano 2GB VendorNVIDIA Affected All 32.x versions prior to 32.7.1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:nvidia:jetson_linux::::::::	32.1 to before 32.7.1	Vulnerable	NVIDIA
cpe:2.3:h:nvidia:jetson_nano:-:::::::*	not specified by NVD	Running on	NVIDIA
cpe:2.3:h:nvidia:jetson_nano_2gb:-:::::::*	not specified by NVD	Running on	NVIDIA

cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:* Versions 32.1 to before 32.7.1 Vulnerable ·NVIDIA
cpe:2.3:h:nvidia:jetson_nano:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
cpe:2.3:h:nvidia:jetson_nano_2gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-21819
2026-10-03 Alias added: GHSA-5q8q-7qqw-cmj3

References

Advisory 1

https://nvidia.custhelp.com/app/answers/detail/a_id/5321

Other 1

https://www.thegoodpenguin.co.uk/blog/pcie-dma-attack-against-a-secured-jetson-nano-cve-2022-21819/

TI-2026-19463 NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic… CVSS 3.1CRITICAL 9.4
TI-2024-00097 Improper handling of exceptional conditions in NVIDIA Jetson AGX Xavier series, Jetson… CVSS 3.1HIGH 8.8
TI-2022-20491 Improper input validation in NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson… CVSS 3.1HIGH 7.9
TI-2026-19469 OS command injection in NVIDIA Jetson Xavier Series, Jetson Orin Series and Jetson Thor CVSS 3.1HIGH 7.6
TI-2022-20492 Stack-based buffer overflow in NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson… CVSS 3.1HIGH 7.8
TI-2021-13407 Integer overflow in NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier NX CVSS 3.1HIGH 8.2

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences