Security Bulletin: NVIDIA SHIELD Tablet Security Updates for CPU Speculative Side Channel Vulnerabilities

NVIDIA SHIELD Tablet Response to CPU Speculative Side Channel Vulnerabilities - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 Go to NVIDIA Product Security.

Bulletin Summary

NVIDIA is providing an initial security update to mitigate aspects of Google Project Zero’s January 3, 2018, publication of novel information disclosure attacks that combine CPU speculative execution with known side channels.

NVIDIA believes SHIELD Tablet GPU hardware is immune to the reported security issue. SHIELD Tablet integrates an Arm (CPU) processor that may, in certain circumstances, benefit from software mitigations to reduce the risk of the exploits identified in the Google Project Zero disclosure. For more information, refer to the Arm Security Update.

This bulletin addresses NVIDIA software updates for SHIELD Tablet to mitigate aspects of the potential Arm CPU vulnerabilities.

These potential vulnerabilities have three known variants:

• Variant 1 (CVE-2017-5753): Software mitigations for the Arm CPU issue are provided with the security update included in this bulletin. NVIDIA expects to work together with its ecosystem partners as future updates are released to further strengthen mitigations for the potentially affected CPU.

• Variant 2 (CVE-2017-5715): Software mitigations for the Arm CPU issue are provided with the security update included in this bulletin. NVIDIA expects to work together with its ecosystem partners as future updates are released to further strengthen mitigations for the potentially affected CPU.

• Variant 3 (CVE-2017-5754): NVIDIA believes that SHIELD Tablet is not vulnerable to this variant.

• Variant 3a (CVE-2017-5754): Based on Arm’s Security Update, NVIDIA believes that SHIELD Tablet does not need software mitigations for this variant.

For updates and additional information, actively monitor the NVIDIA Product Security page.

Vulnerability Details

The following sections summarize the potential vulnerabilities. Descriptions are as published on MITRE and risk assessments follow CVSS.

CVE-2017-5753

Computer systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis.

CVSS Base Score: 8.2 CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVE-2017-5715

Computer systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis.

CVSS Base Score: 8.2 CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVE-2017-5754

Computer systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to unauthorized code with local user access via a side-channel analysis of the data cache.

CVSS Base Score: 7.9 CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

NVIDIA’s risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk of your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk of your specific configuration. NVIDIA doesn’t know of any exploits to these issues at this time.

Updated Products

Product	Integrated CPU	OS
SHIELD Tablet Software	Arm Cortex-A15 processor	Android

Security Updates

Updates for SHIELD are available from Settings >About>System update.

Product	Updated Version
SHIELD Tablet	SHIELD Experience 5.4

Note: If you are using earlier driver branches of the affected products, upgrade to one of the updated supported versions listed.

Acknowledgements

None.