Description
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.
Problem types
CWE-754 Improper Check for Unusual or Exceptional Conditions
Product status
Any version before 24.11
24.11
Credits
Sara Rampazzi, Christina Boucher, Carson Stillman, Jonathan E. Bravo of the University of Florida reported these vulnerabilities to Oxford Nanopore Technologies.
References
www.cisa.gov/...vents/ics-medical-advisories/icsma-25-294-01
github.com/.../csaf_files/OT/white/2025/icsma-25-294-01.json
nanoporetech.com/about/contact
