CVE-2024-0112
Published: 12 February 2025
Summary
CVE-2024-0112 is a high-severity Improper Input Validation (CWE-20) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-0112 is an improper input validation vulnerability (CWE-20) affecting NVIDIA Jetson AGX Orin and NVIDIA IGX Orin software. Published on February 12, 2025, it carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). The flaw arises when an attacker escalates certain permissions to a limited degree, potentially enabling a range of impacts including arbitrary code execution, denial of service, data corruption, information disclosure, or further privilege escalation.
Exploitation requires a local attacker with high privileges (PR:H) and involves high attack complexity (AC:H), with no user interaction needed. Successful attacks can alter the scope (S:C) to achieve high confidentiality, integrity, and availability impacts, such as executing code in a privileged context, corrupting data, leaking sensitive information, or causing system denial of service on the affected Jetson or IGX Orin platforms.
NVIDIA has published a security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5611 providing details on the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15913
Vulnerability details
NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certain permissions to a limited degree. A successful exploit of this vulnerability might lead to code…
more
execution, denial of service, data corruption, information disclosure, or escalation of privilege.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation enables local privilege escalation to arbitrary code execution and further impacts on the affected system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the core improper input validation (CWE-20) flaw by requiring validation of inputs at defined points to prevent exploitation leading to code execution or privilege escalation.
Mandates timely identification, reporting, and correction of flaws like this CVE via patching, directly mitigating the vulnerability as per NVIDIA's security advisory.
Enforces least privilege to limit the scope and impact of exploitation by a local high-privilege (PR:H) attacker seeking further escalation.