CVE-2024-0108: Nvidia Jetson Linux DOS Vulnerability

CVE-2024-0108 Overview

CVE-2024-0108 is a vulnerability in NVIDIA Jetson Linux's NvGPU driver where error handling paths in GPU MMU (Memory Management Unit) mapping code fail to properly clean up after a failed mapping attempt. This improper exception handling (CWE-755) can leave the system in an inconsistent state, potentially allowing attackers to exploit the residual mapping artifacts.

A successful exploitation of this vulnerability may lead to denial of service, arbitrary code execution, and escalation of privileges, making it a significant security concern for embedded systems and edge computing deployments utilizing NVIDIA Jetson hardware.

Critical Impact

Local attackers with low privileges can exploit this GPU driver vulnerability to achieve code execution and escalate privileges across security boundaries, potentially compromising the entire Jetson-based system.

Affected Products

• NVIDIA Jetson Linux
• NVIDIA Jetson AGX Xavier (all memory variants: 8GB, 16GB, 32GB, 64GB, Industrial)
• NVIDIA Jetson Xavier NX (including 16GB variant)
• NVIDIA Jetson TX1 and TX1 L4T
• NVIDIA Jetson TX2 (including 4GB, NX, and TX2i variants)
• NVIDIA Jetson Nano (including 2GB variant)

Discovery Timeline

• August 8, 2024 - CVE-2024-0108 published to NVD
• September 16, 2024 - Last updated in NVD database

Technical Details for CVE-2024-0108

Vulnerability Analysis

The vulnerability resides in the NvGPU driver, which is responsible for managing GPU memory operations on NVIDIA Jetson platforms. Specifically, the issue occurs in the GPU MMU mapping code where error handling paths do not properly clean up resources after a mapping operation fails.

When a GPU memory mapping operation fails due to resource constraints, invalid parameters, or other errors, the driver's error handling code should roll back any partial state changes and release allocated resources. However, in the vulnerable code paths, this cleanup does not occur correctly, leaving stale or partially initialized mapping entries.

This error handling deficiency can result in memory corruption, use of uninitialized data structures, or dangling references that persist beyond the failed operation. An attacker with local access can deliberately trigger mapping failures and then exploit the inconsistent state to achieve privilege escalation or code execution.

Root Cause

The root cause is classified as CWE-755 (Improper Handling of Exceptional Conditions). The NvGPU driver's MMU mapping routines lack proper rollback mechanisms in error paths. When a mapping operation fails midway through execution, the driver does not restore the GPU MMU page tables and associated data structures to their pre-operation state.

This leaves orphaned or corrupted entries in the GPU's memory management structures that can be leveraged by subsequent operations or directly manipulated by a local attacker to achieve code execution with elevated privileges.

Attack Vector

The attack vector is local, requiring an attacker to have authenticated access to the Jetson system with low-privilege user credentials. The attacker can interact with the GPU driver through standard GPU APIs or direct ioctl calls to the driver device nodes.

The exploitation chain typically involves:

1. Triggering a GPU memory mapping operation designed to fail at a specific point
2. Observing or predicting the residual state left by the improper error handling
3. Crafting subsequent GPU operations that leverage the corrupted state
4. Achieving privilege escalation by exploiting the inconsistent MMU entries

The vulnerability has a changed scope in the CVSS assessment, meaning a successful exploit in the GPU driver context can impact resources beyond the vulnerable component, potentially compromising the entire host system. No user interaction is required for exploitation once local access is obtained.

Detection Methods for CVE-2024-0108

Indicators of Compromise

• Unexpected GPU driver crashes or kernel panics in nvgpu kernel module
• Anomalous ioctl call patterns to /dev/nvhost-* or /dev/nvgpu device nodes
• Unusual privilege escalation events from processes with GPU access
• Kernel log entries indicating GPU MMU errors or memory mapping failures
• Processes unexpectedly gaining elevated capabilities after GPU operations

Detection Strategies

• Monitor kernel logs for NvGPU driver errors, particularly those related to MMU operations or memory mapping failures
• Implement system call auditing for ioctl operations targeting GPU device nodes
• Deploy endpoint detection rules that correlate GPU driver errors with subsequent privilege changes
• Use SentinelOne's kernel-level monitoring to detect exploitation attempts targeting GPU drivers

Monitoring Recommendations

• Enable verbose logging for the NvGPU driver to capture detailed error information
• Monitor process privilege changes using Linux audit subsystem, especially for processes with open handles to GPU devices
• Implement runtime integrity checking for critical kernel data structures
• Set up alerts for repeated GPU mapping failures from single processes, which may indicate exploitation attempts

How to Mitigate CVE-2024-0108

Immediate Actions Required

• Apply the security patch provided by NVIDIA for affected Jetson Linux versions immediately
• Review and restrict user access to Jetson systems, limiting local access to trusted users only
• Audit applications using GPU functionality and ensure they run with minimal required privileges
• Consider implementing mandatory access control (AppArmor/SELinux) policies for GPU device access
• Monitor systems for signs of exploitation while patches are being deployed

Patch Information

NVIDIA has released security patches addressing this vulnerability. Administrators should consult the NVIDIA Security Advisory for specific patched versions and update instructions for their Jetson platform variants.

The patch corrects the error handling paths in the GPU MMU mapping code to ensure proper cleanup of failed mapping attempts, preventing the exploitation of residual state.

Workarounds

• Restrict access to GPU device nodes (/dev/nvhost-*, /dev/nvgpu) to trusted users and applications only
• Implement additional access controls using Linux capabilities or mandatory access control frameworks
• Isolate GPU-enabled applications in containers or sandboxed environments with limited system access
• Monitor and audit all GPU driver interactions on affected systems until patches can be applied

# Restrict GPU device access to specific group
sudo chown root:gpu /dev/nvhost-*
sudo chmod 660 /dev/nvhost-*

# Add trusted users to gpu group
sudo usermod -aG gpu trusted_user

# Verify permissions
ls -la /dev/nvhost-* /dev/nvgpu*