NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• google androidall versions
• nvidia shield tv firmwareup to 6.2 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (nvidia). Independent of NVD's CPE analysis and usually ahead of it.

• Nvidia Corporation SHIELD TV

  • NAaffected

Other highest-scoring records for the same primary product.

• CVE-2017-6295NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the
  33Monitor
• CVE-2017-6282NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary l
  31Monitor
• CVE-2017-6296NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of p
  28Monitor
• CVE-2017-6283NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip rese
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.