Critical severity · published Aug 17, 2021
CVE-2021-22156
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QO
Qnx OS For Medical · Blackberry
through 1.1.1 · source: NVD
QO
Qnx OS For Safety · Blackberry
through 1.0.2 · source: NVD
QS
Qnx Software Development Platform · Blackberry
before 6.5.0; 6.5.0; 6.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22156
Patch
https://support.blackberry.com/kb/articleDetail?articleNumber=000082334
Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL
More from Qnx OS For Medical
7.8
CVE-2021-32025
An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x…