製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の NXP i.MX および Vybrid 製品における証明書検証に関する脆弱性

Title	複数の NXP i.MX および Vybrid 製品における証明書検証に関する脆弱性
Summary	複数の NXP i.MX および Vybrid 製品には、証明書検証に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 25, 2017, midnight
Registration Date	Sept. 14, 2017, 5:23 p.m.
Last Update	Sept. 14, 2017, 5:23 p.m.

CVSS3.0 : 警告
Score	6
Vector	CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

CVSS2.0 : 警告
Score	4.4
Vector	AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected System

NXP Semiconductors

i.MX 28 ファームウェア

i.MX 50 ファームウェア

i.MX 53 ファームウェア

i.MX 6Dual ファームウェア

i.MX 6DualLite ファームウェア

i.MX 6DualPlus ファームウェア

i.MX 6Quad ファームウェア

i.MX 6QuadPlus ファームウェア

i.MX 6Solo ファームウェア

i.MX 6SoloLite ファームウェア

i.MX 6SoloX ファームウェア

i.MX 6ULL ファームウェア

i.MX 6UltraLite ファームウェア

i.MX 7Dual ファームウェア

i.MX 7Solo ファームウェア

Vybrid MVF30NN151CKU26 ファームウェア

Vybrid MVF30NS151CKU26 ファームウェア

Vybrid MVF50NN151CMK40 ファームウェア

Vybrid MVF50NN151CMK50 ファームウェア

Vybrid MVF50NS151CMK40 ファームウェア

Vybrid MVF50NS151CMK50 ファームウェア

Vybrid MVF51NN151CMK50 ファームウェア

Vybrid MVF51NS151CMK50 ファームウェア

Vybrid MVF60NN151CMK40 ファームウェア

Vybrid MVF60NN151CMK50 ファームウェア

Vybrid MVF60NS151CMK40 ファームウェア

Vybrid MVF60NS151CMK50 ファームウェア

Vybrid MVF61NN151CMK50 ファームウェア

Vybrid MVF61NS151CMK50 ファームウェア

Vybrid MVF62NN151CMK40 ファームウェア

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7932	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7932
National Vulnerability Database (NVD)
2	CVE-2017-7932	https://nvd.nist.gov/vuln/detail/CVE-2017-7932

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html

ベンダー情報

No	Name	URL
i.MX Community
1	i.MX & Vybrid Security Vulnerability Errata - ERR010872, ERR010873	https://community.nxp.com/docs/DOC-334996

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-17-152-02	https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02

Change Log

No	Changed Details	Date of change
0	[2017年09月14日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-7932

Summary	An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
Publication Date	Aug. 7, 2017, 5:29 p.m.
Registration Date	Jan. 26, 2021, 1:29 p.m.
Last Update	Nov. 21, 2024, 12:32 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf30nn151cku26_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf30nn151cku26:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf30ns151cku26_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf30ns151cku26:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf50nn151cmk40_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf50nn151cmk40:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf50nn151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf50nn151cmk50:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf50ns151cmk40_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf50ns151cmk40:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf50ns151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf50ns151cmk50:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf51nn151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf51nn151cmk50:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf51ns151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf51ns151cmk50:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf60nn151cmk40_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf60nn151cmk40:-:::::::*

Configuration10		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf60ns151cmk40_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf60ns151cmk40:-:::::::*

Configuration11		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf60nn151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf60nn151cmk50:-:::::::*

Configuration12		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf60ns151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf60ns151cmk50:-:::::::*

Configuration13		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf61nn151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf61nn151cmk50:-:::::::*

Configuration14		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf61ns151cmk50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf61ns151cmk50:-:::::::*

Configuration15		or higher	or less	more than	less than
cpe:2.3:o:nxp:vybrid_mvf62nn151cmk40_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:vybrid_mvf62nn151cmk40:-:::::::*

Configuration16		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_50_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_50:-:::::::*

Configuration17		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_53_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_53:-:::::::*

Configuration18		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6ull_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6ull:-:::::::*

Configuration19		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6ultralite_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6ultralite:-:::::::*

Configuration20		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6sololite_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6sololite:-:::::::*

Configuration21		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6solo_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6solo:-:::::::*

Configuration22		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6duallite_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6duallite:-:::::::*

Configuration23		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6solox_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6solox:-:::::::*

Configuration24		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6dual_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6dual:-:::::::*

Configuration25		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6quad_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6quad:-:::::::*

Configuration26		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6quadplus_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6quadplus:-:::::::*

Configuration27		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_6dualplus_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_6dualplus:-:::::::*

Configuration28		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_28_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_28:-:::::::*

Configuration29		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_7dual_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_7dual:-:::::::*

Configuration30		or higher	or less	more than	less than
cpe:2.3:o:nxp:i.mx_7solo_firmware:-:::::::*
execution environment
1	cpe:2.3:h:nxp:i.mx_7solo:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/99966	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/99966	Third Party Advisory VDB Entry
3	https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02	Third Party Advisory US Government Resource VDB Entry
4	https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02	Third Party Advisory US Government Resource VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-295	不正な証明書検証	https://cwe.mitre.org/data/definitions/295.html