CVE-2025-10937
📋 TL;DR
This vulnerability in Oxford Nanopore's MinKNOW software allows local users to cause a denial-of-service by locking a temporary authentication token file during startup. This prevents the software from generating valid tokens and blocks sequencing operations. Systems running MinKNOW version 24.11 or earlier are affected.
💻 Affected Systems
- Oxford Nanopore MinKNOW
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of sequencing operations, preventing scientific research or diagnostic workflows from proceeding.
Likely Case
Temporary service interruption requiring manual intervention to resolve the file lock and restart the software.
If Mitigated
Minimal impact with proper access controls and monitoring in place to detect and prevent unauthorized local access.
🎯 Exploit Status
Requires local access and precise timing during MinKNOW startup to lock the temporary file before it's moved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 24.11
Vendor Advisory: https://nanoporetech.com/software/
Restart Required: No
Instructions:
1. Check current MinKNOW version. 2. Download and install the latest version from Oxford Nanopore's software portal. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict directory permissions
allChange permissions on the temporary directory to prevent unauthorized users from accessing or locking files
chmod 750 /path/to/minknow/temp/directory
chown minknow_user:minknow_group /path/to/minknow/temp/directory
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to MinKNOW systems
- Monitor for unauthorized file locking attempts and implement process isolation
🔍 How to Verify
Check if Vulnerable:
Check MinKNOW version using the software interface or version command. If version is 24.11 or earlier, the system is vulnerable.Check Version:
Check MinKNOW GUI or refer to installation logs for version informationVerify Fix Applied:
Verify MinKNOW version is greater than 24.11 and test that authentication token generation completes successfully during startup.📡 Detection & Monitoring
Log Indicators:
- Failed authentication token generation
- File lock errors in MinKNOW logs
- Repeated startup failures
Network Indicators:
- No network indicators - this is a local file system attack
SIEM Query:
Search for 'authentication token generation failed' OR 'file lock' OR 'flock' in MinKNOW application logs