Nvidia has secured its Android TV-based digital media player Shield TV with an update for Shield Experience against three vulnerabilities. One of them was rated “High” (CVSS base score 7.8 of possible 10), the other two with “Medium “(Scores 6.1 and 5.7). Attackers could misuse the vulnerabilities to create a denial-of-service state, extend their access rights or cause data loss in the course of an irregular reboot.

Remote attacks, however, are probably not possible: According to the CVSS vector information in Nvidia’s current Security Bulletin, attackers require local access or rely on local user interaction (CVE – 2021 – 1068, CVE – 2021 – 1069). In the case of the medium vulnerability CVE – 2021 – 1067 a physical device access should even be required. The bulletin does not reveal any further details on the attack route. The complexity of the attack was rated as low in all three cases.

Shield Experience: All versions prior to 8.2.2 affected According to Nvidia, users can request the required upgrade to Shield Experience 8.2.2 either directly via a notification on the home screen or via Settings> About> System update . All previous Shield Experience versions are vulnerable.

Shield Experience 8.2.2 removes the Android patch level 2020 – 12 – 05 and thus includes the Android security updates from December 2020, but not yet the latest Android updates from January 2021.

(ovw)