CVE-2021-22636: Texas Instruments TI-RTOS Integer Overflow or Wraparound
First published: Mon Nov 20 2023(Updated: )
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Ti Real-time Operating System | ||
| Any of | ||
| Ti Cc3200 | ||
| Ti Cc3220r | ||
| Ti Cc3220s | ||
| Ti Cc3220sf | ||
| Ti Cc3230s | ||
| Ti Cc3230sf | ||
| Ti Cc3235s | ||
| Ti Cc3235sf | ||
| Ti Simplelink Cc13xx Software Development Kit | <4.40.00 | |
| Ti Simplelink Cc26xx Software Development Kit | <4.40.00 | |
| Ti Simplelink Cc32xx Software Development Kit | <4.10.03 | |
| Ti Simplelink Msp432e401y | ||
| Ti Simplelink Msp432e411y | ||
| Multiple Amazon FreeRTOS, Version 10.4.1 | ||
| Multiple Apache Nuttx OS, Version 9.1.0 | ||
| Multiple ARM CMSIS-RTOS2, versions prior to 2.1.3 | ||
| Multiple ARM Mbed OS, Version 6.3.0 | ||
| Multiple ARM mbed-ualloc, Version 1.3.0 | ||
| Multiple BlackBerry QNX SDP Versions 6.5.0 SP1 and earlier | ||
| Multiple BlackBerry QNX OS for Safety Versions 1.0.1 and earlier safety products compliant with IEC 61508 and/or ISO 26262 | ||
| Multiple BlackBerry QNX OS for Medical Versions 1.1 and earlier safety products compliant with IEC 62304 A full list of affected QNX products and versions is available here | ||
| Multiple A full list of affected QNX products and versions is available here | ||
| Multiple Cesanta Software Mongoose OS, v2.17.0 | ||
| Multiple eCosCentric eCosPro RTOS, Versions 2.0.1 through 4.5.3 | ||
| Multiple Google Cloud IoT Device SDK, Version 1.0.2 | ||
| Multiple Media Tek LinkIt SDK, versions prior to 4.6.1 | ||
| Multiple Micrium OS, Versions 5.10.1 and prior | ||
| Multiple Micrium uC/OS: uC/LIB Versions 1.38.xx, Version 1.39.00 | ||
| Multiple NXP MCUXpresso SDK, versions prior to 2.8.2 | ||
| Multiple NXP MQX, Versions 5.1 and prior | ||
| Multiple Redhat newlib, versions prior to 4.0.0 | ||
| Multiple RIOT OS, Version 2020.01.1 | ||
| Multiple Samsung Tizen RT RTOS, versions prior 3.0.GBB | ||
| Multiple TencentOS-tiny, Version 3.1.0 | ||
| Multiple Texas Instruments CC32XX, versions prior to 4.40.00.07 | ||
| Multiple Texas Instruments SimpleLink MSP432E4XX | ||
| Multiple Texas Instruments SimpleLink-CC13XX, versions prior to 4.40.00 | ||
| Multiple Texas Instruments SimpleLink-CC26XX, versions prior to 4.40.00 | ||
| Multiple Texas Instruments SimpleLink-CC32XX, versions prior to 4.10.03 | ||
| Multiple Uclibc-NG, versions prior to 1.0.36 | ||
| Multiple Windriver VxWorks, prior to 7.0 | ||
| Multiple Zephyr Project RTOS, versions prior to 2.5 |
Remedy
Texas Instruments CC32XX – Update to v4.40.00.07 Texas Instruments SimpleLink CC13X0 – Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html Texas Instruments SimpleLink CC13X2-CC26X2 – Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html Texas Instruments SimpleLink CC2640R2 – Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html Texas Instruments SimpleLink MSP432E4 – Confirmed. No update currently planned
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-22636?
CVE-2021-22636 is a vulnerability in Texas Instruments TI-RTOS that can result in code execution due to an integer overflow vulnerability in 'HeapMem_allocUnprotected'.
How does CVE-2021-22636 affect Texas Instruments TI-RTOS?
CVE-2021-22636 affects Texas Instruments TI-RTOS when configured to use the HeapMem heap.
What is the severity of CVE-2021-22636?
CVE-2021-22636 has a severity level of 7.4 (High).
How can CVE-2021-22636 be fixed?
To fix CVE-2021-22636, users should update to the latest version of Texas Instruments TI-RTOS and apply any patches or security updates provided by the vendor.
Where can I find more information about CVE-2021-22636?
More information about CVE-2021-22636 can be found on the CISA website and the Texas Instruments website.
- collector/nvd-api
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/event
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/ti
- canonical/ti real-time operating system
- canonical/ti cc3200
- canonical/ti cc3220r
- canonical/ti cc3220s
- canonical/ti cc3220sf
- canonical/ti cc3230s
- canonical/ti cc3230sf
- canonical/ti cc3235s
- canonical/ti cc3235sf
- canonical/ti simplelink cc13xx software development kit
- canonical/ti simplelink cc26xx software development kit
- canonical/ti simplelink cc32xx software development kit
- canonical/ti simplelink msp432e401y
- canonical/ti simplelink msp432e411y
- vendor/multiple
- canonical/multiple amazon freertos, version 10.4.1
- canonical/multiple apache nuttx os, version 9.1.0
- canonical/multiple arm cmsis-rtos2, versions prior to 2.1.3
- canonical/multiple arm mbed os, version 6.3.0
- canonical/multiple arm mbed-ualloc, version 1.3.0
- canonical/multiple blackberry qnx sdp versions 6.5.0 sp1 and earlier
- canonical/multiple blackberry qnx os for safety versions 1.0.1 and earlier safety products compliant with iec 61508 and/or iso 26262
- canonical/multiple blackberry qnx os for medical versions 1.1 and earlier safety products compliant with iec 62304 a full list of affected qnx products and versions is available here
- canonical/multiple a full list of affected qnx products and versions is available here
- canonical/multiple cesanta software mongoose os, v2.17.0
- canonical/multiple ecoscentric ecospro rtos, versions 2.0.1 through 4.5.3
- canonical/multiple google cloud iot device sdk, version 1.0.2
- canonical/multiple media tek linkit sdk, versions prior to 4.6.1
- canonical/multiple micrium os, versions 5.10.1 and prior
- canonical/multiple micrium uc/os: uc/lib versions 1.38.xx, version 1.39.00
- canonical/multiple nxp mcuxpresso sdk, versions prior to 2.8.2
- canonical/multiple nxp mqx, versions 5.1 and prior
- canonical/multiple redhat newlib, versions prior to 4.0.0
- canonical/multiple riot os, version 2020.01.1
- canonical/multiple samsung tizen rt rtos, versions prior 3.0.gbb
- canonical/multiple tencentos-tiny, version 3.1.0
- canonical/multiple texas instruments cc32xx, versions prior to 4.40.00.07
- canonical/multiple texas instruments simplelink msp432e4xx
- canonical/multiple texas instruments simplelink-cc13xx, versions prior to 4.40.00
- canonical/multiple texas instruments simplelink-cc26xx, versions prior to 4.40.00
- canonical/multiple texas instruments simplelink-cc32xx, versions prior to 4.10.03
- canonical/multiple uclibc-ng, versions prior to 1.0.36
- canonical/multiple windriver vxworks, prior to 7.0
- canonical/multiple zephyr project rtos, versions prior to 2.5