CVE-2021-32025 Privilege escalation in QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS)
An attacker can escalate privileges in the QNX Neutrino Kernel to access data, modify behavior, or crash the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32025?
CVE-2021-32025 is a high-severity vulnerability in BlackBerry QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS), published on 9 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system.
Weakness: CWE-368
Which versions are affected by CVE-2021-32025?
It affects 4 products.
Products include Blackberry Qnx Momentics, Blackberry Qnx Os for Medical, Blackberry Qnx Os for Safety, Blackberry Qnx Software Development Platform.
How do I fix CVE-2021-32025?
No fix has been published for CVE-2021-32025 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32025 being exploited?
There is no known exploitation of CVE-2021-32025 in the wild and no public exploit code.
Other vulnerabilities in BlackBerry QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS)
Sources
Also known as GHSA-wwrv-4gjc-852w.