Lucene search

[email protected]CVE-2021-32025

HistoryMar 10, 2022 - 5:42 p.m.

CVE-2021-32025

2022-03-1017:42:14

[email protected]

web.nvd.nist.gov

cve-2021-32025

qnx

neutrino kernel

elevation of privilege

vulnerability

security

qnx software development platform

qnx momentics

qnx os

qnx for medical

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

12.5%

JSON

An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system.

Affected configurations

NVD

Node

blackberryqnx_momenticsMatch6.3.0

blackberryqnx_momenticsMatch6.3.2

blackberryqnx_software_development_platformRange6.4.0–7.0

blackberryqnx_os_for_medicalRange1.0–1.1.2

blackberryqnx_os_for_medicalMatch2.0.0

blackberryqnx_os_for_safetyRange1.0.0–1.0.3

blackberryqnx_os_for_safetyRange2.0.0–2.0.2

CPENameOperatorVersion
blackberry:qnx_momenticsblackberry qnx momenticseq6.3.0
blackberry:qnx_momenticsblackberry qnx momenticseq6.3.2
blackberry:qnx_software_development_platformblackberry qnx software development platformle7.0
blackberry:qnx_os_for_medicalblackberry qnx os for medicallt1.1.2
blackberry:qnx_os_for_medicalblackberry qnx os for medicaleq2.0.0
blackberry:qnx_os_for_safetyblackberry qnx os for safetylt1.0.3
blackberry:qnx_os_for_safetyblackberry qnx os for safetylt2.0.2

CPE	Name	Operator	Version
blackberry:qnx_momentics	blackberry qnx momentics	eq	6.3.0
blackberry:qnx_momentics	blackberry qnx momentics	eq	6.3.2
blackberry:qnx_software_development_platform	blackberry qnx software development platform	le	7.0
blackberry:qnx_os_for_medical	blackberry qnx os for medical	lt	1.1.2
blackberry:qnx_os_for_medical	blackberry qnx os for medical	eq	2.0.0
blackberry:qnx_os_for_safety	blackberry qnx os for safety	lt	1.0.3
blackberry:qnx_os_for_safety	blackberry qnx os for safety	lt	2.0.2

CNA Affected

[
  {
    "product": "QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "QNX SDP 6.4.0 to 7.0"
      },
      {
        "status": "affected",
        "version": "QNX Momentics all 6.3.x versions"
      },
      {
        "status": "affected",
        "version": "QNX OS for Safety versions 1.0.0 to 1.0.2 safety products compliant with IEC 61508 and/or ISO 26262"
      },
      {
        "status": "affected",
        "version": "QNX OS for Safety versions 2.0.0 to 2.0.1 safety products compliant with IEC 61508 and/or ISO 26262"
      },
      {
        "status": "affected",
        "version": "QNX OS for Medical versions 1.0.0 to 1.1.1 safety products compliant with IEC 62304"
      },
      {
        "status": "affected",
        "version": "QNX OS for Medical versions 2.0.0 safety product compliant with IEC 62304"
      }
    ]
  }
]

References

support.blackberry.com/kb/articleDetail?articleNumber=000090868

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

12.5%

JSON

Related for CVE-2021-32025

cvelist1 prion1 nvd1