CVE-2021-30636: Integer Overflow

Q: What is the severity of CVE-2021-30636?

The severity of CVE-2021-30636 is considered high due to the potential for memory corruption leading to denial of service or arbitrary code execution.

Q: How do I fix CVE-2021-30636?

To mitigate CVE-2021-30636, upgrade to MediaTek LinkIt SDK version 4.6.1 or later, or apply the recommended patches from the vendor.

Q: Which versions of MediaTek LinkIt SDK are affected by CVE-2021-30636?

MediaTek LinkIt SDK versions prior to 4.6.1 are affected by CVE-2021-30636.

Q: Can other software be affected by CVE-2021-30636?

Yes, CVE-2021-30636 impacts various software including Amazon FreeRTOS, Apache Nuttx OS, and several ARM and QNX products.

Q: What types of vulnerabilities are associated with CVE-2021-30636?

CVE-2021-30636 is associated with memory corruption vulnerabilities due to integer overflow during memory allocation.

Published Jan 24, 2022

Updated

In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled memory allocation by pvPortCalloc and pvPortRealloc.

Affected Software

30 affected components

MediaTek Linkit Software Development Kit<4.6.1

Multiple Amazon FreeRTOS, Version 10.4.1

Multiple Apache Nuttx OS, Version 9.1.0

Multiple ARM CMSIS-RTOS2, versions prior to 2.1.3

Multiple ARM Mbed OS, Version 6.3.0

Multiple ARM mbed-ualloc, Version 1.3.0

Multiple BlackBerry QNX SDP Versions 6.5.0 SP1 and earlier

Multiple BlackBerry QNX OS for Safety Versions 1.0.1 and earlier safety products compliant with IEC 61508 and/or ISO 26262

Multiple BlackBerry QNX OS for Medical Versions 1.1 and earlier safety products compliant with IEC 62304 A full list of affected QNX products and versions is available here

Multiple A full list of affected QNX products and versions is available here

Multiple Cesanta Software Mongoose OS, v2.17.0

Multiple eCosCentric eCosPro RTOS, Versions 2.0.1 through 4.5.3

Multiple Google Cloud IoT Device SDK, Version 1.0.2

Multiple Media Tek LinkIt SDK, versions prior to 4.6.1

Multiple Micrium OS, Versions 5.10.1 and prior

Multiple Micrium uC/OS: uC/LIB Versions 1.38.xx, Version 1.39.00

Multiple NXP MCUXpresso SDK, versions prior to 2.8.2

Multiple NXP MQX, Versions 5.1 and prior

Multiple Redhat newlib, versions prior to 4.0.0

Multiple RIOT OS, Version 2020.01.1

Multiple Samsung Tizen RT RTOS, versions prior 3.0.GBB

Multiple TencentOS-tiny, Version 3.1.0

Multiple Texas Instruments CC32XX, versions prior to 4.40.00.07

Multiple Texas Instruments SimpleLink MSP432E4XX

Multiple Texas Instruments SimpleLink-CC13XX, versions prior to 4.40.00

Multiple Texas Instruments SimpleLink-CC26XX, versions prior to 4.40.00

Multiple Texas Instruments SimpleLink-CC32XX, versions prior to 4.10.03

Multiple Uclibc-NG, versions prior to 1.0.36

Multiple Windriver VxWorks, prior to 7.0

Multiple Zephyr Project RTOS, versions prior to 2.5

Event History

Jan 24, 2022

CVE Published

via MITRE·12:27 AM

Data Sourced

via MITRE·12:27 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-119-04

Frequently Asked Questions

What is the severity of CVE-2021-30636?

The severity of CVE-2021-30636 is considered high due to the potential for memory corruption leading to denial of service or arbitrary code execution.

How do I fix CVE-2021-30636?

To mitigate CVE-2021-30636, upgrade to MediaTek LinkIt SDK version 4.6.1 or later, or apply the recommended patches from the vendor.

Which versions of MediaTek LinkIt SDK are affected by CVE-2021-30636?

MediaTek LinkIt SDK versions prior to 4.6.1 are affected by CVE-2021-30636.

Can other software be affected by CVE-2021-30636?