Vulnerability-Lookup - Search a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

FKIE_CVE-2021-27502

Vulnerability from fkie_nvd - Published: 2023-11-21 18:15 - Updated: 2024-11-21 05:58

Severity ?

7.4 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

References

URL	Tags
ics-cert@hq.dhs.gov	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov	https://www.ti.com/tool/TI-RTOS-MCU	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.ti.com/tool/TI-RTOS-MCU	Product

Impacted products

Vendor	Product	Version
ti	real-time_operating_system	-
ti	cc3200	-
ti	cc3220r	-
ti	cc3220s	-
ti	cc3220sf	-
ti	cc3230s	-
ti	cc3230sf	-
ti	cc3235s	-
ti	cc3235sf	-
ti	simplelink_cc13xx_software_development_kit	*
ti	simplelink_cc26xx_software_development_kit	*
ti	simplelink_cc32xx_software_development_kit	*
ti	simplelink_msp432e401y	-
ti	simplelink_msp432e411y	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ti:real-time_operating_system:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E289611E-871B-433E-BF10-CDABF650AAC9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ti:cc3200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1738237-A64A-40A3-B201-7E0005CCA3A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D436F6E3-B044-457E-B67D-9C76105F0847",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE6E103B-F34A-477C-907D-B4EAE295D90E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71ABA01C-4CB1-4DD5-9263-79A58BED3A9B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E34FD25E-D5C2-40F0-81E2-A8A102934E8C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3408EEBE-25EC-4CEA-8E96-DCFF7C66B3F6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "370E65A3-17A4-4E05-BB4A-6C09BB5249CA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B06F9E6A-690D-4E95-ADD4-927995EE5523",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97B4CA27-1024-4347-8C0B-A8848950CB5B",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCC0C102-7DCB-4959-91C6-ECA8429BB1A2",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61CF4AB1-347E-42F9-89FB-350445ED7E70",
              "versionEndExcluding": "4.10.03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "538BC9EE-7C51-41CC-9A58-5FEB3261EF7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC7C493D-DAC1-4FBD-A056-C9D5CF98F9E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Texas Instruments TI-RTOS, when configured to use HeapMem heap(default),\n malloc returns a valid pointer to a small buffer on extremely large \nvalues, which can trigger an integer overflow vulnerability in \n\u0027HeapMem_allocUnprotected\u0027 and result in code execution."
    },
    {
      "lang": "es",
      "value": "Texas Instruments TI-RTOS, cuando se configura para usar el heap HeapMem (predeterminado), malloc devuelve un puntero v\u00e1lido a un b\u00fafer peque\u00f1o en valores extremadamente grandes, lo que puede desencadenar una vulnerabilidad de desbordamiento de enteros en \u0027HeapMem_allocUnprotected\u0027 y provocar la ejecuci\u00f3n de c\u00f3digo."
    }
  ],
  "id": "CVE-2021-27502",
  "lastModified": "2024-11-21T05:58:07.200",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 5.9,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-11-21T18:15:07.510",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2021-27429

Vulnerability from fkie_nvd - Published: 2023-11-20 19:15 - Updated: 2024-11-21 05:57

Severity ?

7.4 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.

References

URL	Tags
ics-cert@hq.dhs.gov	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov	https://www.ti.com/tool/TI-RTOS-MCU	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.ti.com/tool/TI-RTOS-MCU	Product

Impacted products

Vendor	Product	Version
ti	real-time_operating_system	-
ti	cc3200	-
ti	cc3220r	-
ti	cc3220s	-
ti	cc3220sf	-
ti	cc3230s	-
ti	cc3230sf	-
ti	cc3235s	-
ti	cc3235sf	-
ti	simplelink_cc13xx_software_development_kit	*
ti	simplelink_cc26xx_software_development_kit	*
ti	simplelink_cc32xx_software_development_kit	*
ti	simplelink_msp432e401y	-
ti	simplelink_msp432e411y	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ti:real-time_operating_system:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E289611E-871B-433E-BF10-CDABF650AAC9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ti:cc3200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1738237-A64A-40A3-B201-7E0005CCA3A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D436F6E3-B044-457E-B67D-9C76105F0847",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE6E103B-F34A-477C-907D-B4EAE295D90E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71ABA01C-4CB1-4DD5-9263-79A58BED3A9B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E34FD25E-D5C2-40F0-81E2-A8A102934E8C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3408EEBE-25EC-4CEA-8E96-DCFF7C66B3F6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "370E65A3-17A4-4E05-BB4A-6C09BB5249CA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B06F9E6A-690D-4E95-ADD4-927995EE5523",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97B4CA27-1024-4347-8C0B-A8848950CB5B",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCC0C102-7DCB-4959-91C6-ECA8429BB1A2",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61CF4AB1-347E-42F9-89FB-350445ED7E70",
              "versionEndExcluding": "4.10.03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "538BC9EE-7C51-41CC-9A58-5FEB3261EF7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC7C493D-DAC1-4FBD-A056-C9D5CF98F9E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \n\n"
    },
    {
      "lang": "es",
      "value": "Texas Instruments TI-RTOS devuelve un puntero v\u00e1lido a un b\u00fafer peque\u00f1o en valores extremadamente grandes. Esto puede desencadenar una vulnerabilidad de desbordamiento de enteros en \u0027HeapTrack_alloc\u0027 y provocar la ejecuci\u00f3n de c\u00f3digo."
    }
  ],
  "id": "CVE-2021-27429",
  "lastModified": "2024-11-21T05:57:58.357",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 5.9,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-11-20T19:15:08.357",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2021-22636

Vulnerability from fkie_nvd - Published: 2023-11-20 19:15 - Updated: 2024-11-21 05:50

Severity ?

7.4 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

References

URL	Tags
ics-cert@hq.dhs.gov	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov	https://www.ti.com/tool/TI-RTOS-MCU	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.ti.com/tool/TI-RTOS-MCU	Product

Impacted products

Vendor	Product	Version
ti	real-time_operating_system	-
ti	cc3200	-
ti	cc3220r	-
ti	cc3220s	-
ti	cc3220sf	-
ti	cc3230s	-
ti	cc3230sf	-
ti	cc3235s	-
ti	cc3235sf	-
ti	simplelink_cc13xx_software_development_kit	*
ti	simplelink_cc26xx_software_development_kit	*
ti	simplelink_cc32xx_software_development_kit	*
ti	simplelink_msp432e401y	-
ti	simplelink_msp432e411y	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ti:real-time_operating_system:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E289611E-871B-433E-BF10-CDABF650AAC9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ti:cc3200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1738237-A64A-40A3-B201-7E0005CCA3A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D436F6E3-B044-457E-B67D-9C76105F0847",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE6E103B-F34A-477C-907D-B4EAE295D90E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3220sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71ABA01C-4CB1-4DD5-9263-79A58BED3A9B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E34FD25E-D5C2-40F0-81E2-A8A102934E8C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3230sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3408EEBE-25EC-4CEA-8E96-DCFF7C66B3F6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "370E65A3-17A4-4E05-BB4A-6C09BB5249CA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ti:cc3235sf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B06F9E6A-690D-4E95-ADD4-927995EE5523",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97B4CA27-1024-4347-8C0B-A8848950CB5B",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCC0C102-7DCB-4959-91C6-ECA8429BB1A2",
              "versionEndExcluding": "4.40.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61CF4AB1-347E-42F9-89FB-350445ED7E70",
              "versionEndExcluding": "4.10.03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "538BC9EE-7C51-41CC-9A58-5FEB3261EF7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC7C493D-DAC1-4FBD-A056-C9D5CF98F9E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\n\n\n\n\nTexas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in \u0027HeapMem_allocUnprotected\u0027 and result in code execution. \n\n\n\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Texas Instruments TI-RTOS, cuando se configura para usar el heap HeapMem (predeterminado), malloc devuelve un puntero v\u00e1lido a un b\u00fafer peque\u00f1o en valores extremadamente grandes, lo que puede desencadenar una vulnerabilidad de desbordamiento de enteros en \u0027HeapMem_allocUnprotected\u0027 y provocar la ejecuci\u00f3n de c\u00f3digo."
    }
  ],
  "id": "CVE-2021-22636",
  "lastModified": "2024-11-21T05:50:21.587",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 5.9,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-11-20T19:15:08.173",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.ti.com/tool/TI-RTOS-MCU"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2020-16630

Vulnerability from fkie_nvd - Published: 2021-09-20 20:15 - Updated: 2024-11-21 05:07

Severity ?

6.8 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile’s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission.

References

URL	Tags
cve@mitre.org	http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html	Vendor Advisory
cve@mitre.org	https://www.usenix.org/system/files/sec20-zhang-yue.pdf	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.usenix.org/system/files/sec20-zhang-yue.pdf	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
ti	15.4-stack	-
ti	ble5-stack	-
ti	dynamic_multi-protocal_manager	-
ti	easylink	-
ti	openthread	-
ti	z-stack	-
ti	real-time_operating_system	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ti:15.4-stack:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2973A2C-67E6-4064-A2A9-E4122E201DDF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:ble5-stack:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E161F37-86D3-4558-91B4-086528A351AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:dynamic_multi-protocal_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9951BB2-E930-4C92-B673-501591679002",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:easylink:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "74934E63-1140-4F9B-BC05-3739E62B9DE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:openthread:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3586ABB-3E4A-4BAD-B9F4-5EB6775AFEF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ti:z-stack:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA516494-4D9A-4275-A7BA-A82699625477",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ti:real-time_operating_system:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E289611E-871B-433E-BF10-CDABF650AAC9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TI\u2019s BLE stack caches and reuses the LTK\u2019s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile\u2019s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission."
    },
    {
      "lang": "es",
      "value": "La pila BLE de TI almacena en cach\u00e9 y reusa la propiedad del LTK para un m\u00f3vil vinculado. Una LTK puede ser una clave no autenticada y sin protecci\u00f3n MITM creada por Just Works o una clave autenticada y con protecci\u00f3n MITM creada por Passkey Entry, Numeric Comparison u OOB. Supongamos que un m\u00f3vil v\u00edctima usa el emparejamiento seguro para emparejarse con un dispositivo BLE v\u00edctima basado en chips TI y genera una LTK autenticada y de protecci\u00f3n MITM. Si un m\u00f3vil falso con la direcci\u00f3n MAC del m\u00f3vil v\u00edctima usa Just Works y se empareja con el dispositivo v\u00edctima, el LTK generado sigue teniendo la propiedad de autenticaci\u00f3n y protecci\u00f3n MITM. Por lo tanto, el m\u00f3vil falso puede acceder a los atributos con el permiso de lectura/escritura autenticado"
    }
  ],
  "id": "CVE-2020-16630",
  "lastModified": "2024-11-21T05:07:11.853",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.5,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-09-20T20:15:11.337",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-27502 (GCVE-0-2021-27502)

Vulnerability from cvelistv5 – Published: 2023-11-21 17:41 – Updated: 2024-08-03 21:26

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:26:09.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\nTexas Instruments TI-RTOS, when configured to use HeapMem heap(default),\n malloc returns a valid pointer to a small buffer on extremely large \nvalues, which can trigger an integer overflow vulnerability in \n\u0027HeapMem_allocUnprotected\u0027 and result in code execution. \n\n \u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Texas Instruments TI-RTOS, when configured to use HeapMem heap(default),\n malloc returns a valid pointer to a small buffer on extremely large \nvalues, which can trigger an integer overflow vulnerability in \n\u0027HeapMem_allocUnprotected\u0027 and result in code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-21T17:41:08.040Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-27502",
    "datePublished": "2023-11-21T17:41:08.040Z",
    "dateReserved": "2021-02-19T17:45:42.346Z",
    "dateUpdated": "2024-08-03T21:26:09.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22636 (GCVE-0-2021-22636)

Vulnerability from cvelistv5 – Published: 2023-11-20 19:02 – Updated: 2024-08-03 18:44

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:44:13.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTexas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in \u0027HeapMem_allocUnprotected\u0027 and result in code execution. \u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\n\n\n\n\n\n\nTexas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in \u0027HeapMem_allocUnprotected\u0027 and result in code execution. \n\n\n\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T19:04:56.253Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-22636",
    "datePublished": "2023-11-20T19:02:30.434Z",
    "dateReserved": "2021-01-05T18:23:02.914Z",
    "dateUpdated": "2024-08-03T18:44:13.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-27429 (GCVE-0-2021-27429)

Vulnerability from cvelistv5 – Published: 2023-11-20 19:00 – Updated: 2024-08-03 20:48

Summary

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:48:17.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T19:00:19.757Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-27429",
    "datePublished": "2023-11-20T19:00:19.757Z",
    "dateReserved": "2021-02-19T17:45:42.315Z",
    "dateUpdated": "2024-08-03T20:48:17.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-16630 (GCVE-0-2020-16630)

Vulnerability from cvelistv5 – Published: 2021-09-20 19:20 – Updated: 2024-08-04 13:45

Summary

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile’s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://software-dl.ti.com/simplelink/esd/simpleli…	x_refsource_MISC
	https://www.usenix.org/system/files/sec20-zhang-yue.pdf	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:45:33.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TI\u2019s BLE stack caches and reuses the LTK\u2019s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile\u2019s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-20T19:20:50",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-16630",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TI\u2019s BLE stack caches and reuses the LTK\u2019s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile\u2019s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html",
              "refsource": "MISC",
              "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
            },
            {
              "name": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf",
              "refsource": "MISC",
              "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-16630",
    "datePublished": "2021-09-20T19:20:50",
    "dateReserved": "2020-08-04T00:00:00",
    "dateUpdated": "2024-08-04T13:45:33.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-27502 (GCVE-0-2021-27502)

Vulnerability from nvd – Published: 2023-11-21 17:41 – Updated: 2024-08-03 21:26

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:26:09.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\nTexas Instruments TI-RTOS, when configured to use HeapMem heap(default),\n malloc returns a valid pointer to a small buffer on extremely large \nvalues, which can trigger an integer overflow vulnerability in \n\u0027HeapMem_allocUnprotected\u0027 and result in code execution. \n\n \u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Texas Instruments TI-RTOS, when configured to use HeapMem heap(default),\n malloc returns a valid pointer to a small buffer on extremely large \nvalues, which can trigger an integer overflow vulnerability in \n\u0027HeapMem_allocUnprotected\u0027 and result in code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-21T17:41:08.040Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-27502",
    "datePublished": "2023-11-21T17:41:08.040Z",
    "dateReserved": "2021-02-19T17:45:42.346Z",
    "dateUpdated": "2024-08-03T21:26:09.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22636 (GCVE-0-2021-22636)

Vulnerability from nvd – Published: 2023-11-20 19:02 – Updated: 2024-08-03 18:44

Summary

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:44:13.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTexas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in \u0027HeapMem_allocUnprotected\u0027 and result in code execution. \u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\n\n\n\n\n\n\nTexas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in \u0027HeapMem_allocUnprotected\u0027 and result in code execution. \n\n\n\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T19:04:56.253Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-22636",
    "datePublished": "2023-11-20T19:02:30.434Z",
    "dateReserved": "2021-01-05T18:23:02.914Z",
    "dateUpdated": "2024-08-03T18:44:13.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-27429 (GCVE-0-2021-27429)

Vulnerability from nvd – Published: 2023-11-20 19:00 – Updated: 2024-08-03 20:48

Summary

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	https://www.ti.com/tool/TI-RTOS-MCU

Impacted products

Vendor

Product

Version

Texas Instruments

CC32XX

Affected: 0 , < 4.40.00.07 (custom)

Texas Instruments	SimpleLink MSP432E4XX	Affected: all versions
Texas Instruments	SimpleLink-CC13XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC26XX	Affected: 0 , < 4.40.00 (custom)
Texas Instruments	SimpleLink-CC32XX	Affected: 0 , < 4.10.03 (custom)

Credits

David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:48:17.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T19:00:19.757Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-27429",
    "datePublished": "2023-11-20T19:00:19.757Z",
    "dateReserved": "2021-02-19T17:45:42.315Z",
    "dateUpdated": "2024-08-03T20:48:17.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-16630 (GCVE-0-2020-16630)

Vulnerability from nvd – Published: 2021-09-20 19:20 – Updated: 2024-08-04 13:45

Summary

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile’s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://software-dl.ti.com/simplelink/esd/simpleli…	x_refsource_MISC
	https://www.usenix.org/system/files/sec20-zhang-yue.pdf	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:45:33.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TI\u2019s BLE stack caches and reuses the LTK\u2019s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile\u2019s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-20T19:20:50",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-16630",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TI\u2019s BLE stack caches and reuses the LTK\u2019s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile\u2019s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html",
              "refsource": "MISC",
              "url": "http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html"
            },
            {
              "name": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf",
              "refsource": "MISC",
              "url": "https://www.usenix.org/system/files/sec20-zhang-yue.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-16630",
    "datePublished": "2021-09-20T19:20:50",
    "dateReserved": "2020-08-04T00:00:00",
    "dateUpdated": "2024-08-04T13:45:33.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

12 vulnerabilities found for real-time_operating_system by ti

FKIE_CVE-2021-27502

FKIE_CVE-2021-27429

FKIE_CVE-2021-22636

FKIE_CVE-2020-16630

CVE-2021-27502 (GCVE-0-2021-27502)

CVE-2021-22636 (GCVE-0-2021-22636)

CVE-2021-27429 (GCVE-0-2021-27429)

CVE-2020-16630 (GCVE-0-2020-16630)

CVE-2021-27502 (GCVE-0-2021-27502)

CVE-2021-22636 (GCVE-0-2021-22636)

CVE-2021-27429 (GCVE-0-2021-27429)

CVE-2020-16630 (GCVE-0-2020-16630)