CVE-2024-0148: NVIDIA Jetson Linux UEFI RCE Vulnerability

CVE-2024-0148 Overview

CVE-2024-0148 affects NVIDIA Jetson Linux and IGX OS images. The vulnerability resides in the Unified Extensible Firmware Interface (UEFI) firmware Recovery Mode (RCM) boot path. An unprivileged attacker with physical access to the device can load untrusted code during the RCM boot sequence. Successful exploitation can lead to arbitrary code execution, privilege escalation, data tampering, denial of service, and information disclosure. The scope extends beyond the vulnerable component to other parts of the platform, indicating a trust boundary crossing during early boot.

Critical Impact
Physical attackers can subvert the UEFI RCM boot path to load unsigned code, breaking the platform's chain of trust and compromising confidentiality, integrity, and availability.

Affected Products

NVIDIA Jetson Linux
NVIDIA IGX OS image
NVIDIA devices supporting the UEFI RCM boot mode

Discovery Timeline

2025-02-25 - CVE-2024-0148 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-0148

Vulnerability Analysis

The flaw is categorized under [CWE-447] Unimplemented or Unsupported Feature in UI, and functionally represents a weakness in the trust decisions made by the UEFI firmware during RCM boot. RCM (Recovery Mode) is intended for device recovery and re-flashing operations. In vulnerable NVIDIA Jetson Linux and IGX OS builds, the RCM boot flow accepts code without adequately enforcing signature verification against the platform's secure boot root of trust.

An attacker with physical access can place the device into RCM mode, connect over the recovery interface, and supply attacker-controlled payloads. Because the compromise occurs at the firmware level, malicious code executes before operating system defenses initialize. The Common Vulnerability Scoring System (CVSS) scope flag indicates impact reaches components beyond the UEFI firmware itself, including the operating system, sensitive data, and downstream trusted hardware components.

Root Cause

The root cause is insufficient validation of code loaded through the UEFI RCM boot path. The firmware trusts input supplied through the recovery interface without enforcing the same signature and integrity checks applied to the normal boot chain. This breaks the secure boot chain of trust at its earliest link.

Attack Vector

Exploitation requires physical access to the target device and the ability to trigger RCM boot mode, typically through hardware straps, buttons, or debug interfaces. No authentication or user interaction on the operating system is required. The attacker connects to the device's recovery USB interface and delivers a crafted payload that the UEFI firmware executes.

No public proof-of-concept exploit is available for CVE-2024-0148, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the NVIDIA Support Answer for vendor technical details.

Detection Methods for CVE-2024-0148

Indicators of Compromise

Unexpected reboots into RCM mode or evidence of RCM boot activity in device logs.
Firmware or bootloader hash mismatches against known-good baselines for Jetson Linux and IGX OS.
Unauthorized physical connections to the device's USB recovery port.
Presence of unsigned or unrecognized binaries in the boot partitions after inspection.

Detection Strategies

Measure and attest boot components using Trusted Platform Module (TPM) or the platform's measured boot facilities, comparing values to a known-good baseline.
Compare deployed UEFI firmware versions to the fixed versions listed in the NVIDIA advisory.
Audit device inventories to identify Jetson and IGX assets deployed in physically exposed environments.

Monitoring Recommendations

Enable and centralize boot integrity telemetry from Jetson and IGX endpoints.
Monitor physical access controls, tamper switches, and USB port activity on deployed devices.
Track NVIDIA PSIRT advisories for follow-on firmware updates related to the RCM boot path.

How to Mitigate CVE-2024-0148

Immediate Actions Required

Apply the firmware updates published by NVIDIA in the NVIDIA Support Answer 5617 advisory.
Inventory all Jetson Linux and IGX OS devices and prioritize patching those in physically accessible locations.
Restrict physical access to devices, including USB recovery ports and RCM-trigger pins or buttons.
Validate secure boot configuration and confirm signature enforcement after patching.

Patch Information

NVIDIA has released updated Jetson Linux and IGX OS images that address the RCM boot mode issue. Consult the vendor advisory at NVIDIA Support Answer 5617 for the specific fixed versions, upgrade procedures, and impacted product families. Follow NVIDIA's documented flashing workflow to ensure the updated firmware is applied to all boot partitions.

Workarounds

Physically secure devices in locked enclosures or tamper-evident housings to prevent RCM triggering.
Disable or physically block USB recovery interfaces where operationally feasible.
Enforce chassis intrusion detection and physical monitoring for high-value deployments.
Treat any device suspected of RCM tampering as compromised and reflash from a trusted host.

bash

# Verify installed Jetson Linux / L4T release on the device
cat /etc/nv_tegra_release

# Check current UEFI firmware version reported by the platform
sudo dmesg | grep -i -E 'uefi|bootloader|tegra'

# After patching, confirm the running image matches the fixed release
# documented in NVIDIA Support Answer 5617 before returning the
# device to production.