CVE-2021-3420: Integer Overflow

Q: What is the severity of CVE-2021-3420?

The severity of CVE-2021-3420 is rated as high due to the potential for a heap-based buffer overflow, which can lead to system compromise.

Q: How do I fix CVE-2021-3420?

To fix CVE-2021-3420, you should upgrade Newlib to version 4.0.0 or later.

Q: Which versions of Newlib are affected by CVE-2021-3420?

Newlib versions prior to 4.0.0 are affected by CVE-2021-3420.

Q: What types of systems are vulnerable to CVE-2021-3420?

CVE-2021-3420 affects systems running Newlib, including various embedded operating systems and frameworks.

Q: Is CVE-2021-3420 related to memory management vulnerabilities?

Yes, CVE-2021-3420 involves improper overflow validation in memory allocation functions, leading to potential buffer overflows.

Published Mar 2, 2021

Updated

A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nanomemalign, nanovalloc, nanopvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.

Affected Software

34 affected componentsFixes available

redhat/newlib<4.0.0

4.0.0

Multiple Amazon FreeRTOS, Version 10.4.1

Multiple Apache Nuttx OS, Version 9.1.0

Multiple ARM CMSIS-RTOS2, versions prior to 2.1.3

Multiple ARM Mbed OS, Version 6.3.0

Multiple ARM mbed-ualloc, Version 1.3.0

Multiple BlackBerry QNX SDP Versions 6.5.0 SP1 and earlier

Multiple BlackBerry QNX OS for Safety Versions 1.0.1 and earlier safety products compliant with IEC 61508 and/or ISO 26262

Multiple BlackBerry QNX OS for Medical Versions 1.1 and earlier safety products compliant with IEC 62304 A full list of affected QNX products and versions is available here

Multiple A full list of affected QNX products and versions is available here

Multiple Cesanta Software Mongoose OS, v2.17.0

Multiple eCosCentric eCosPro RTOS, Versions 2.0.1 through 4.5.3

Multiple Google Cloud IoT Device SDK, Version 1.0.2

Multiple Media Tek LinkIt SDK, versions prior to 4.6.1

Multiple Micrium OS, Versions 5.10.1 and prior

Multiple Micrium uC/OS: uC/LIB Versions 1.38.xx, Version 1.39.00

Multiple NXP MCUXpresso SDK, versions prior to 2.8.2

Multiple NXP MQX, Versions 5.1 and prior

Multiple Redhat newlib, versions prior to 4.0.0

Multiple RIOT OS, Version 2020.01.1

Multiple Samsung Tizen RT RTOS, versions prior 3.0.GBB

Multiple TencentOS-tiny, Version 3.1.0

Multiple Texas Instruments CC32XX, versions prior to 4.40.00.07

Multiple Texas Instruments SimpleLink MSP432E4XX

Multiple Texas Instruments SimpleLink-CC13XX, versions prior to 4.40.00

Multiple Texas Instruments SimpleLink-CC26XX, versions prior to 4.40.00

Multiple Texas Instruments SimpleLink-CC32XX, versions prior to 4.10.03

Multiple Uclibc-NG, versions prior to 1.0.36

Multiple Windriver VxWorks, prior to 7.0

Multiple Zephyr Project RTOS, versions prior to 2.5

Newlib Project Newlib<4.0.0

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/newlib to a version that resolves this vulnerability.
Fixed in 4.0.0
Upgrade
Upgrade newlib to a version that resolves this vulnerability.
Fixed in 4.0.0

Event History

Mar 5, 2021

CVE Published

via MITRE·07:19 PM

Data Sourced

via MITRE·07:19 PM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-119-04

Frequently Asked Questions

What is the severity of CVE-2021-3420?

The severity of CVE-2021-3420 is rated as high due to the potential for a heap-based buffer overflow, which can lead to system compromise.

How do I fix CVE-2021-3420?