Hacking Nvidia Shield TV Hit With High-Severity Security Flaws - Possible New Entry Points?

[mattyxarope]

So NVIDIA detailed two new exploits for the bootloader of the NVIDIA Shield TV:

CVE‑2019‑5699
NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lead to buffer overflow resulting in escalation of privileges and code execution.

and

CVE‑2019‑5700
NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate the fields of the boot image, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.

"The first flaw (CVE‑2019‑5699) stems from the bootloader in the Nvidia Tegra SoC of Nvidia Shield TV. This is the piece of code that runs before an operating systems starts to run, and loads the operating system when a computer turns on. The issue is due to the software performing an incorrect bounds check. Bounds checking is a method of detecting whether a variable is within “bounds” before it is used in the memory buffer, which is a region of a physical memory storage. This flaw can lead to a buffer overflow; when more data is sent to a memory block (buffer) than it can hold. Attackers could leverage this flaw to launch escalation-of-privilege and code-execution attacks.

The other flaw (CVE‑2019‑5700) exists in how the bootloader interacts with the boot image, a type of disk image that provides critical files necessary to load the device. The boot image typically contains a field that indicates a header version; the bootloader must check this header version field and parse the header accordingly. However, according to Nvidia, the bootloader in the vulnerable versions does not correctly validate the fields of the boot image. This glitch can lead to code execution, denial-of-service, escalation-of-privilege and information disclosure."

https://nvidia.custhelp.com/app/answers/detail/a_id/4875

Would these be applicable to the bootloader of the Switch?

 

[leerpsp]

If that is the case then we can get a cold boot cfw if it runs before an operating system.

 

[linuxares]

Yeah the first exploit if it's possible on the Switches is definitely a coldboot possibility, if it's the same on the Switch, CVE‑2019‑5700 however sounds like the RCM bug no?

EDIT: What I get it seems that they are both software patchable. So we should not update if Nintendo magically release a new firmware update the next couple of weeks if these are exploitable.

 

[Ericthegreat]

I didn't think about this when I read about the security issue, interesting, if someone doesn't say somthing soon, Nintendo will patch it, and everyone will update.

 

[pman152]

If people are curious (like I was) this doesn't seem to be the previously found selfblow exploit, as that one has a similar but different CVE

 

[linuxares]

If people are curious (like I was) this doesn't seem to be the previously found selfblow exploit, as that one has a similar but different CVE

selfblow? I haven't heard about that one before either. Since it's software patchable it sounds like it's something with the Android system no?

 

[pman152]

selfblow? I haven't heard about that one before either. Since it's software patchable it sounds like it's something with the Android system no?

Selfblow isn't a switch vulnerability because the switch doesn't use the same bootloader as typical tegra devices (according to SciresM)

 

[mattyxarope]

Selfblow isn't a switch vulnerability because the switch doesn't use the same bootloader as typical tegra devices (according to SciresM)

In which case these two might be useless, unfortunately.

 

[pman152]

In which case these two might be useless, unfortunately.

Yep sadly

 

[mattyxarope]

Yep sadly

I would have to assume that the two bootloaders share some commonality though, right?

 

[pman152]

I would have to assume that the two bootloaders share some commonality though, right?

Not really, they would act differently depending on what they want to do on boot, there may be some similar code in play but generally speaking no

 

[kevin corms]

Well on the other hand, the fact that it runs android means it isnt very secure in the first place. Its a great device for what it is, but I wouldnt trust my bank info or anything on it.

 

[linuxares]

Well on the other hand, the fact that it runs android means it isnt very secure in the first place. Its a great device for what it is, but I wouldnt trust my bank info or anything on it.

No real electronic is "secure". It's just safe until someone really wanna get in.

 

[kevin corms]

No real electronic is "secure". It's just safe until someone really wanna get in.

There are variable levels of security, but yes nothing is perfect. I dont get this argument that seems to come straight from google, people are basically saying since any security can be theoretically defeated that security is just a waste of time? That kind of logic just doesnt fly with me, sorry.

 

[ZachyCatGames]

I would have to assume that the two bootloaders share some commonality though, right?

The Switch’s bootloader is called pk1ldr, it’s completely custom, and has the single purpose of loading package1. pk1ldr isn’t exploiable in any useful way.