Nvidia

An issue exists where an actor capable of executing code within the build of a scanned project can obtain the Black Duck API token. This occurs because the token is passed through the ambient process environment and inherited by subprocesses launched during build capture and signature scanning. This issue specifically affects configurations where the token is provided via the `BLACKDUCK API TOKEN` or `BD HUB TOKEN` environment variables.

Improper input validation may allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. MPU (Memory Protection Unit) is a hardware component that monitors memory access to prevent tasks from accessing unauthorized memory regions.

A missing privilege verification in the secure context cleanup handler allows local users to trigger a use-after-free condition in secure-world memory. This occurs through the SVC handler used for secure context deallocation. A use-after-free is a scenario where a program continues to use a pointer after it has been freed, which can lead to crashes or unauthorized memory access.

Missing minimum size validation in secure context allocation allows local users to corrupt secure-world heap metadata. This occurs via an out-of-bounds write when an undersized stack size parameter is used within the `SecureContext AllocateContext()` function.

Missing queue-set type validation in the `xQueueAddToSet()` function may allow an unprivileged task to read privileged kernel memory. This issue occurs on MPU-enabled ports when `configUSE QUEUE SETS` is set to 1. MPU (Memory Protection Unit) is a hardware component that monitors memory access to prevent unauthorized access to specific memory regions.