Blackberry Ltd
Monthly
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the traceparser library (libtraceparser), where the decode() function fails to properly validate input from kernel trace event log (.kev) files. A local attacker who supplies a maliciously corrupted .kev file can crash - or potentially run code within - any host or target process that parses it with libtraceparser. Reported by BlackBerry with no public exploit identified at time of analysis; the CVSS 7.0 (AC:H, UI:R) reflects that exploitation requires a victim to process the attacker's crafted file.
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a stack buffer overflow in the entry handler of the TraceEvent() system call, affecting QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical. An attacker able to run code on the target can craft malicious TraceEvent() arguments to corrupt kernel stack memory, leaking sensitive kernel data, altering kernel state, or crashing the RTOS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation is rated high-complexity (AC:H) despite requiring no prior privileges.
Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permits local attackers holding the PROCMGR_AID_TRACE kernel capability to trigger information disclosure, data tampering, or a kernel crash across three distinct product lines including safety- and medical-certified variants. Affected deployments span QNX Software Development Platform 7.0-7.1, QNX OS for Safety through 2.2.8, and QNX OS for Medical through 2.0.2. No public exploit or active exploitation has been identified; EPSS places this in the 1st percentile for near-term in-the-wild exploitation probability, and SSVC confirms exploitation status as none, though SSVC technical impact is rated total reflecting the kernel-level blast radius when conditions are met.
Kernel crash in BlackBerry QNX Neutrino is triggerable by any local, unprivileged user via a malformed SchedGet() system call, resulting in full system availability loss. Affected platforms include QNX Software Development Platform 7.0 and 7.1, QNX OS for Safety (multiple branches up to 2.2.8), and QNX OS for Medical 2.0.2 and earlier. No active exploitation has been identified (EPSS 0.11%, CISA SSVC exploitation: none), but the safety-critical operational contexts in which QNX is deployed - automotive, medical devices, industrial automation - make a kernel crash disproportionately consequential relative to the moderate CVSS score.
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the traceparser library (libtraceparser), where the decode() function fails to properly validate input from kernel trace event log (.kev) files. A local attacker who supplies a maliciously corrupted .kev file can crash - or potentially run code within - any host or target process that parses it with libtraceparser. Reported by BlackBerry with no public exploit identified at time of analysis; the CVSS 7.0 (AC:H, UI:R) reflects that exploitation requires a victim to process the attacker's crafted file.
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a stack buffer overflow in the entry handler of the TraceEvent() system call, affecting QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical. An attacker able to run code on the target can craft malicious TraceEvent() arguments to corrupt kernel stack memory, leaking sensitive kernel data, altering kernel state, or crashing the RTOS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation is rated high-complexity (AC:H) despite requiring no prior privileges.
Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permits local attackers holding the PROCMGR_AID_TRACE kernel capability to trigger information disclosure, data tampering, or a kernel crash across three distinct product lines including safety- and medical-certified variants. Affected deployments span QNX Software Development Platform 7.0-7.1, QNX OS for Safety through 2.2.8, and QNX OS for Medical through 2.0.2. No public exploit or active exploitation has been identified; EPSS places this in the 1st percentile for near-term in-the-wild exploitation probability, and SSVC confirms exploitation status as none, though SSVC technical impact is rated total reflecting the kernel-level blast radius when conditions are met.
Kernel crash in BlackBerry QNX Neutrino is triggerable by any local, unprivileged user via a malformed SchedGet() system call, resulting in full system availability loss. Affected platforms include QNX Software Development Platform 7.0 and 7.1, QNX OS for Safety (multiple branches up to 2.2.8), and QNX OS for Medical 2.0.2 and earlier. No active exploitation has been identified (EPSS 0.11%, CISA SSVC exploitation: none), but the safety-critical operational contexts in which QNX is deployed - automotive, medical devices, industrial automation - make a kernel crash disproportionately consequential relative to the moderate CVSS score.