Magic Leap One
Search documents
22岁女天才攻破英伟达芯片!
国芯网· 2025-12-31 04:32
Core Viewpoint - The article discusses a significant security breach involving the NVIDIA Tegra X2 chip, which has been fully compromised by a young security researcher, Amber Katze, allowing potential access to millions of devices that utilize this chip, including MR glasses and Tesla vehicles [1][3]. Group 1: Security Breach Details - Amber Katze announced the complete compromise of the NVIDIA Tegra X2 chip's secure boot mechanism, which affects devices that can connect to its USB interface [1][3]. - The motivation behind the research was the shutdown of the Magic Leap One's startup server, rendering the device unusable, prompting Katze to restore its functionality [3]. - Two critical vulnerabilities were identified: "sparsehax," related to the logic flaw during the decompression of SparseFS images, and "dtbhax," which allows persistent access through specific core device tree blocks [3][4]. Group 2: Exploitation and Impact - Katze successfully executed unsigned code on the Magic Leap One by exploiting these vulnerabilities, breaching the system's initial defenses [3]. - A severe vulnerability was found in the BootROM code, which is unmodifiable by NVIDIA due to its read-only nature, allowing devices to bypass the secure boot chain and take full control [4]. - Although the attack requires physical access to the USB port, Katze developed a complex exploitation chain that achieved high-level code execution [4].