CVE-2017-7932 Security feature bypass in NXP i.MX Product Family
Attackers can bypass signature verification to execute unsigned images on NXP i.MX devices configured with security enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7932?
CVE-2017-7932 is a medium-severity vulnerability in NXP i.MX Product Family, published on 7 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
Weakness: CWE-295
Which versions are affected by CVE-2017-7932?
It affects 30 products.
Products include Nxp I.mx 28 Firmware, Nxp I.mx 50 Firmware, Nxp I.mx 53 Firmware, Nxp I.mx 6dual Firmware, Nxp I.mx 6duallite Firmware, Nxp I.mx 6dualplus Firmware and 24 more.
How do I fix CVE-2017-7932?
No fix has been published for CVE-2017-7932 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7932 being exploited?
There is no known exploitation of CVE-2017-7932 in the wild and no public exploit code.
Sources
Also known as GHSA-mm3w-pr4h-xqq8.