CVE-2021-22156
CVSS V2 Medium 6.8
CVSS V3 Critical 9.8
Description
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.
Overview
- CVE ID
- CVE-2021-22156
- Assigner
- secure@blackberry.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-08-17T19:15:08
- Last Modified Date
- 2021-08-30T11:26:01
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:blackberry:qnx_software_development_platform:*:*:*:*:*:*:*:* | 1 | OR | 6.5.0 | |
| cpe:2.3:a:blackberry:qnx_software_development_platform:6.5.0:-:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:blackberry:qnx_software_development_platform:6.5.0:sp1:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:blackberry:qnx_os_for_medical:*:*:*:*:*:*:*:* | 1 | OR | 1.1.1 | |
| cpe:2.3:o:blackberry:qnx_os_for_safety:*:*:*:*:*:*:*:* | 1 | OR | 1.0.2 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.8
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://support.blackberry.com/kb/articleDetail?articleNumber=000082334 | Patch Vendor Advisory |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-22156 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22156 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 06:55:44 | Added to TrackCVE | |||
| 2022-12-05 08:24:56 | 2021-08-17T19:15Z | 2021-08-17T19:15:08 | CVE Published Date | updated |
| 2022-12-05 08:24:56 | 2021-08-30T11:26:01 | CVE Modified Date | updated | |
| 2022-12-05 08:24:56 | Analyzed | Vulnerability Status | updated |