- Forums
- Product Forums
- General Purpose MicrocontrollersGeneral Purpose Microcontrollers
- i.MX Forumsi.MX Forums
- QorIQ Processing PlatformsQorIQ Processing Platforms
- Identification and SecurityIdentification and Security
- Power ManagementPower Management
- Wireless ConnectivityWireless Connectivity
- RFID / NFCRFID / NFC
- Advanced AnalogAdvanced Analog
- Neural Processing UnitsNeural Processing Units
- MCX Microcontrollers
- S32G
- S32K
- S32V
- MPC5xxx
- Other NXP Products
- S12 / MagniV Microcontrollers
- Powertrain and Electrification Analog Drivers
- Sensors
- Vybrid Processors
- Digital Signal Controllers
- 8-bit Microcontrollers
- ColdFire/68K Microcontrollers and Processors
- PowerQUICC Processors
- OSBDM and TBDML
- S32M
- S32Z/E
-
- Solution Forums
- Software Forums
- MCUXpresso Software and ToolsMCUXpresso Software and Tools
- CodeWarriorCodeWarrior
- MQX Software SolutionsMQX Software Solutions
- Model-Based Design Toolbox (MBDT)Model-Based Design Toolbox (MBDT)
- FreeMASTER
- eIQ Machine Learning Software
- Embedded Software and Tools Clinic
- S32 SDK
- S32 Design Studio
- GUI Guider
- Zephyr Project
- Voice Technology
- Application Software Packs
- Secure Provisioning SDK (SPSDK)
- Processor Expert Software
- Generative AI & LLMs
-
- Topics
- Mobile Robotics - Drones and RoversMobile Robotics - Drones and Rovers
- NXP Training ContentNXP Training Content
- University ProgramsUniversity Programs
- Rapid IoT
- NXP Designs
- SafeAssure-Community
- OSS Security & Maintenance
- Using Our Community
-
- Cloud Lab Forums
-
- Knowledge Bases
- ARM Microcontrollers
- i.MX Processors
- Identification and Security
- Model-Based Design Toolbox (MBDT)
- QorIQ Processing Platforms
- S32 Automotive Processing Platform
- Wireless Connectivity
- CodeWarrior
- MCUXpresso Suite of Software and Tools
- MQX Software Solutions
- RFID / NFC
- Advanced Analog
- Neural Processing Units
-
- NXP Tech Blogs
- Home
- :
- Translated Content
- :
- Multi Source Translation Content
- :
- 2412394_en-US
2412394_en-US
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
2412394_en-US
2412394_en-US
Hi,
we are using NXP Android Automotive 16.0.0_1.3.0 with kernel 6.12 and the prebuilt revisions documented by NXP:
platform/prebuilts/clang/host/linux-x86 66acdd82ee62e4aaa4248f03191c59dfed9db193 kernel/prebuilts/build-tools 3c5e4f14b451ec85167c38b917d2459687abd7f4 platform/prebuilts/rust 5156e7f81ae254c79ee736e44c960e75ad685c67 platform/prebuilts/clang-tools 17329f6590e2872dcf04a0c96a176be089470cd9
These are the revisions listed in the NXP Android Automotive User's Guide for this release.
The build works with these revisions, but our container vulnerability scan reports several HIGH and CRITICAL findings inside the supplied Android prebuilts.
For example, the Clang prebuilts contain embedded Go standard libraries. For clang-r536225/bin/clang, the scan reports:
Total: 22 HIGH: 21 CRITICAL: 1 Go stdlib version: v1.23.2 Example: CVE-2025-68121 crypto/tls - incorrect certificate validation
The same finding pattern also appears in clang++ and clang-tidy, and in the newer clang-r547379 binaries where the embedded Go version is v1.23.4.
The NXP-pinned kernel/prebuilts/build-tools also contains affected soong_zip binaries with the same Go-stdlib finding pattern.
The Rust prebuilts also contain findings in shipped Cargo lock files, for example:
thin-vec 0.2.13 CVE-2026-6654 fixed in 0.2.16 hashbrown 0.15.0 GHSA-wwq9-3cpr-mm53 fixed in 0.15.1
We do not want to replace the documented revisions with arbitrary newer AOSP commits, because these prebuilts are part of the NXP kernel/U-Boot build environment and we want to preserve compatibility with Android Automotive 16.0.0_1.3.0 / kernel 6.12.
Are there newer NXP-recommended or known-compatible commit IDs for these prebuilts?
In particular, we are looking for updated revisions for:
platform/prebuilts/clang/host/linux-x86 kernel/prebuilts/build-tools platform/prebuilts/rust platform/prebuilts/clang-tools
Has NXP, or anyone in the community, already updated these revisions and verified that the following still work?
We would prefer to update the affected prebuilts instead of permanently suppressing the security findings.
I have attached the failed vulnerability scan log for reference. It contains the complete findings for the affected Clang, kernel build-tools and Rust prebuilts, including detected embedded versions and available fixed versions.
Thanks.