Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Just yesterday a vulnerability--Fusée Gelée--was found in the Nintendo Switch NVIDIA Tegra chips that will purportedly allow linux to be loaded onto the devices, among other things.
However, even on the FAQ page, I still don't see anything about how this vulnerability allows arbitrary code to be run.
How does this exploit actually work?
On 2018-04-23, the ReSwitched team publicly released their exploit. The FAQ you linked has not been updated since (as of the writing of this post). A summary of the exploit is available in the vulnerability disclosure report:
The USB software stack provided inside the boot instruction rom (IROM/bootROM) contains a copy operation whose length can be controlled by an attacker. By carefully constructing a USB control request, an attacker can leverage this vulnerability to copy the contents of an attacker-controlled buffer over the active execution stack, gaining control of the Boot and Power Management processor (BPMP) before any lock-outs or privilege reductions occur. This execution can then be used to exfiltrate secrets and to load arbitrary code onto the main CPU Complex (CCPLEX) "application processors" at the highest possible level of privilege (typically as the TrustZone Secure Monitor at PL3/EL3).
The report also contains specific details of the exploit. As the report states, it has been known by multiple entities for some time. More details relevant for end users are availailable in the Q&É.
