cve-2021-26706
Vulnerability from cvelistv5
Published
2022-01-24 00:19
Modified
2024-08-03 20:33
Severity ?
Summary
An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.
References
cve@mitre.orghttps://docs.silabs.com/micrium/latest/micrium-common/Vendor Advisory
cve@mitre.orghttps://micrium.atlassian.net/wiki/spaces/libdoc138/Third Party Advisory
cve@mitre.orghttps://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://docs.silabs.com/micrium/latest/micrium-common/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://micrium.atlassian.net/wiki/spaces/libdoc138/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:39.555Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.silabs.com/micrium/latest/micrium-common/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://micrium.atlassian.net/wiki/spaces/libdoc138/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-24T00:19:42",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.silabs.com/micrium/latest/micrium-common/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://micrium.atlassian.net/wiki/spaces/libdoc138/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-26706",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.silabs.com/micrium/latest/micrium-common/",
              "refsource": "MISC",
              "url": "https://docs.silabs.com/micrium/latest/micrium-common/"
            },
            {
              "name": "https://micrium.atlassian.net/wiki/spaces/libdoc138/",
              "refsource": "MISC",
              "url": "https://micrium.atlassian.net/wiki/spaces/libdoc138/"
            },
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04",
              "refsource": "MISC",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-26706",
    "datePublished": "2022-01-24T00:19:42",
    "dateReserved": "2021-02-05T00:00:00",
    "dateUpdated": "2024-08-03T20:33:39.555Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-26706\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-01-24T01:15:07.820\",\"lastModified\":\"2024-11-21T05:56:42.573\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado un problema en el archivo lib_mem.c en Micrium uC/OS uC/LIB versiones 1.38.x y 1.39.00. Las siguientes funciones de asignaci\u00f3n de memoria no comprueban el desbordamiento de enteros cuando es asignado un pool cuyo tama\u00f1o excede el espacio de direcciones: Mem_PoolCreate, Mem_DynPoolCreate y Mem_DynPoolCreateHW. Dado que estas funciones usan la multiplicaci\u00f3n para calcular el tama\u00f1o de los pools, la operaci\u00f3n puede causar un desbordamiento de enteros si los argumentos son lo suficientemente grandes. El pool de memoria resultante ser\u00e1 m\u00e1s peque\u00f1o de lo esperado y puede ser explotado por un atacante\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADEC04DF-BBB7-4E00-9AF1-3B52DA9256F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5095D618-E1AF-45DD-9922-2D3432C95D7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1ED2590-7E89-42A8-AC6A-961B1AE72F8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.03:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C968427F-019A-4935-AB46-C1B37B82F7E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C96AD897-3BC7-4670-B10A-F0EE7EB0BA69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.38.05:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8A49CE1-1BF8-4942-8D22-241F0911203F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:micrium:uc\\\\/lib:1.39.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94FF181B-D5BC-4713-A61B-6F96D522A1CC\"}]}]}],\"references\":[{\"url\":\"https://docs.silabs.com/micrium/latest/micrium-common/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://micrium.atlassian.net/wiki/spaces/libdoc138/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://docs.silabs.com/micrium/latest/micrium-common/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://micrium.atlassian.net/wiki/spaces/libdoc138/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.