Summary
Successful exploitation of these vulnerabilities could result in unexpected behavior such as a crash or a remote code injection/execution.
Vulnerabilities 24
-
High 7.4
Texas Instruments TI-RTOS Integer Overflow or Wraparound
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
-
High 7.4
Texas Instruments TI-RTOS Integer Overflow or Wraparound
Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.
-
High 7.4
Texas Instruments TI-RTOS Integer Overflow or Wraparound
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
-
High 7.4
Texas Instruments FREERTOS Integer Overflow or Wraparound
Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.
-
High 7.3
integer overflow in calloc
In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corrupti…
-
High 7.3
NXP MQX Integer Overflow or Wraparound
NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code…
-
High 7.3
uClibc-ng Integer Overflow or Wraparound
uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
-
High 7.3
NXP MCUXpresso SDK Integer Overflow or Wraparound
NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a…
-
High 7.3
Cesanta Software Mongoose-OS Integer Overflow or Wraparound
Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
-
High 7.3
RIOT OS Integer Overflow or Wraparound
RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
-
High 7.3
ARM CMSIS RTOS2 Integer Overflow or Wraparound
ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.
-
High 7.3
ARM mbed-ualloc memory library Integer Overflow or Wraparound
ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
-
High 7.3
ARM mbed Integer Overflow or Wraparound
ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
-
High 7.3
TencentOS-tiny Integer Overflow or Wraparound
TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavio…
-
Medium 6.5
Micrium OS Integer Overflow or Wraparound
Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such…
-
Medium 4.6
eCosCentric eCosPro RTOS Integer Overflow or Wraparound
eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
-
Unscored —
An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a …
-
Unscored —
Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper mem…
-
Unscored —
malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code i…
-
Unscored —
An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functi…
-
Unscored —
In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled…
-
Unscored —
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.
-
Unscored —
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.
-
Unscored —
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions …
Revision history
-
#6
ICSA-21-119-04 Multiple RTOS (Update E)
-
#5
ICSA-21-119-04 Multiple RTOS (Update D)
-
#4
ICSA-21-119-04 Multiple RTOS (Update C)
-
#3
ICSA-21-119-04 Multiple RTOS (Update B)
-
#2
ICSA-21-119-04 Multiple RTOS (Update A)
-
#1
ICSA-21-119-04 Multiple RTOS
References
-
ICS Advisory ICSA-21-119-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04
-
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B