Lucene search

[email protected]CVE-2021-27429

HistoryNov 20, 2023 - 7:15 p.m.

CVE-2021-27429

2023-11-2019:15:08

CWE-190

[email protected]

web.nvd.nist.gov

ti-rtos

cve-2021-27429

integer overflow

heaptrack_alloc

code execution

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in ‘HeapTrack_alloc’ and result in code execution.

Affected configurations

NVD

Node

tireal-time_operating_systemMatch-

AND

ticc3200Match-

ticc3220rMatch-

ticc3220sMatch-

ticc3220sfMatch-

ticc3230sMatch-

ticc3230sfMatch-

ticc3235sMatch-

ticc3235sfMatch-

Node

tisimplelink_cc13xx_software_development_kitRange<4.40.00

tisimplelink_cc26xx_software_development_kitRange<4.40.00

tisimplelink_cc32xx_software_development_kitRange<4.10.03

tisimplelink_msp432e401yMatch-

tisimplelink_msp432e411yMatch-

CPENameOperatorVersion
ti:real-time_operating_systemti real-time operating systemeq-

CPE	Name	Operator	Version
ti:real-time_operating_system	ti real-time operating system	eq	-

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CC32XX",
    "vendor": "Texas Instruments",
    "versions": [
      {
        "lessThan": "4.40.00.07",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SimpleLink MSP432E4XX",
    "vendor": "Texas Instruments",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SimpleLink-CC13XX",
    "vendor": "Texas Instruments",
    "versions": [
      {
        "lessThan": "4.40.00",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SimpleLink-CC26XX",
    "vendor": "Texas Instruments",
    "versions": [
      {
        "lessThan": "4.40.00",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SimpleLink-CC32XX",
    "vendor": "Texas Instruments",
    "versions": [
      {
        "lessThan": "4.10.03",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-21-119-04

www.ti.com/tool/TI-RTOS-MCU

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

Related for CVE-2021-27429

prion1 cvelist1 nvd1 ics1