{"id":"CVE-2021-34394","aliases":["EUVD-2021-21052","GHSA-chcf-c8w2-7x53"],"status":"published","title":"Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with...","description":"Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00264,"percentile":0.18445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2021-06-22T21:25:29Z","modified":"2026-06-17T03:55:46Z","products":[{"vendor":"nvidia","product":"jetson_linux"},{"vendor":"nvidia","product":"nvidia jetson tx2 series, tx2 nx, agx xavier series, xavier nx"}],"references":[{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5205","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34394"},{"url":"https://github.com/advisories/GHSA-chcf-c8w2-7x53"}],"sources":{"cve":[{"id":"CVE-2021-34394","description":"Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification.","status":"published","published":"2021-06-22T21:25:29Z","modified":"2024-08-04T00:12:50.176Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2021-21052","description":"Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification.","status":"published","published":"2021-06-22T21:25:29Z","modified":"2024-08-04T00:12:50Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:24:32.445199Z"}],"ghsa":[{"id":"GHSA-chcf-c8w2-7x53","title":"Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with...","description":"Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with multiple occurrences of the same parameter. The deserialization of untrusted data might allow an attacker to exploit the deserializer to impact code execution.","status":"published","published":"2022-05-24T19:06:01Z","modified":"2023-01-29T05:08:05Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:46:12.058225Z"}],"nvd":[{"id":"CVE-2021-34394","description":"Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification.","status":"published","published":"2021-06-22T22:15:09.277Z","modified":"2026-06-17T03:55:46.627Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:54.892562Z"}]}}