CVE-2021-22156: Integer Overflow
First published: Tue Aug 17 2021(Updated: )
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.
Credit: secure@blackberry.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon FreeRTOS | ||
| Apache NuttX | ||
| ARM CMSIS-RTOS2 | ||
| Arm Mbed OS | ||
| Arm Mbed ualloc | ||
| QNX | ||
| BlackBerry QNX OS for Safety | ||
| BlackBerry QNX OS for Medical | ||
| QNX | ||
| Mongoose OS | ||
| eCosCentric eCosPro RTOS | ||
| Google Cloud IoT Device SDK | ||
| MediaTek LinkIt SDK | ||
| Micrium OS | ||
| Micrium uC/OS | ||
| NXP MCUXpresso SDK | ||
| NXP MQX | ||
| newlib | ||
| RIOT OS | ||
| Samsung Tizen RT | ||
| TencentOS-tiny | ||
| Texas Instruments SimpleLink CC32XX | ||
| Texas Instruments SimpleLink MSP432E4 SDK | ||
| Texas Instruments SimpleLink CC13X2 SDK | ||
| Texas Instruments SimpleLink CC26XX | ||
| Texas Instruments SimpleLink CC32XX | ||
| uClibc | ||
| Wind River VxWorks | ||
| Zephyr Project RTOS | ||
| BlackBerry QNX | <6.5.0 | |
| BlackBerry QNX | =6.5.0 | |
| BlackBerry QNX | =6.5.0-sp1 | |
| BlackBerry QNX | <=1.1.1 | |
| BlackBerry QNX | <=1.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-22156?
CVE-2021-22156 is an integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to...
What is the severity of CVE-2021-22156?
The severity of CVE-2021-22156 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2021-22156?
Affected versions include BlackBerry® QNX Software Development Platform versions 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier.
How does CVE-2021-22156 impact the BlackBerry® QNX Software Development Platform?
CVE-2021-22156 allows an attacker to exploit an integer overflow vulnerability in the calloc() function of the C runtime library, potentially leading to unauthorized access or denial of service.
Are there any references or additional information available for CVE-2021-22156?
Yes, you can find more information about CVE-2021-22156 on the official BlackBerry support website [1] and the Cisco Security Advisory [2].
- agent/type
- agent/author
- agent/remedy
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/weakness
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/multiple
- canonical/amazon freertos
- canonical/apache nuttx
- canonical/arm cmsis-rtos2
- canonical/arm mbed os
- canonical/arm mbed ualloc
- canonical/qnx
- canonical/blackberry qnx os for safety
- canonical/blackberry qnx os for medical
- canonical/mongoose os
- canonical/ecoscentric ecospro rtos
- canonical/google cloud iot device sdk
- canonical/mediatek linkit sdk
- canonical/micrium os
- canonical/micrium uc/os
- canonical/nxp mcuxpresso sdk
- canonical/nxp mqx
- canonical/newlib
- canonical/riot os
- canonical/samsung tizen rt
- canonical/tencentos-tiny
- canonical/texas instruments simplelink cc32xx
- canonical/texas instruments simplelink msp432e4 sdk
- canonical/texas instruments simplelink cc13x2 sdk
- canonical/texas instruments simplelink cc26xx
- canonical/uclibc
- canonical/wind river vxworks
- canonical/zephyr project rtos
- vendor/blackberry
- canonical/blackberry qnx
- version/blackberry qnx/6.5.0
- version/blackberry qnx/6.5.0-sp1
- version/blackberry qnx/1.1.1
- version/blackberry qnx/1.0.2