Executive brief
A security vulnerability has been identified in BlueChi, a tool used in Red Hat's In-Vehicle Operating System (RHIVOS) to manage services across different parts of a vehicle's computer system. An attacker who already has high-level access to one part of the system could exploit this flaw to take control of the main host system. This could lead to unauthorized control over vehicle services and a total compromise of the system's security.
Technical details
A vulnerability classified as Incorrect Authorization (CWE-863) exists in BlueChi, a multi-node systemd service controller. The flaw stems from improper enforcement of systemd service dependencies across nodes, specifically within the 'proxy-service' feature. An attacker with root privileges on a managed node (qm) can exploit this to create or override service unit files that affect the host node. This cross-node dependency issue allows for privilege escalation from a managed node to the host. The issue is addressed in BlueChi versions 1.0.0 and later by making the proxy-service feature configurable and restricted.
Affected products
- Eclipse Foundation BlueChi < 1.0.0
- Red Hat Red Hat In-Vehicle Operating System 1 (RHIVOS)
Timeline
- 2025-05-22: patched: Fix committed to BlueChi repository
- 2025-12-24: disclosed: CVE published to NVD
References
- https://github.com/eclipse-bluechi/bluechi
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2025-2515
- https://bugzilla.redhat.com/show_bug.cgi?id=2353313
- https://github.com/eclipse-bluechi/bluechi/commit/fe0d28301ce2bd45f0b1d8a98a94efef799fbc73
- https://github.com/eclipse-bluechi/bluechi/issues/1069
- https://github.com/eclipse-bluechi/bluechi/pull/1073