FKIE_CVE-2021-22156

Vulnerability from fkie_nvd - Published: 2021-08-17 19:15 - Updated: 2025-08-22 16:15
Severity ?
9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.
References
secure@blackberry.comhttps://support.blackberry.com/kb/articleDetail?articleNumber=000082334Patch, Vendor Advisory
secure@blackberry.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdLThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.blackberry.com/kb/articleDetail?articleNumber=000082334Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdLThird Party Advisory
Impacted products
Vendor Product Version
blackberry qnx_software_development_platform *
blackberry qnx_software_development_platform 6.5.0
blackberry qnx_software_development_platform 6.5.0
blackberry qnx_os_for_medical *
blackberry qnx_os_for_safety *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6FCB90F-1888-4350-A16E-5F4951F903B3",
              "versionEndExcluding": "6.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:6.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "B18FCC7D-290C-4FC7-80B7-C678515E403C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:6.5.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "11F2C680-2F44-4CBC-BC7E-B608726302D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:blackberry:qnx_os_for_medical:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "75A18CC9-673C-4FA8-875E-08925D2A97AB",
              "versionEndIncluding": "1.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:blackberry:qnx_os_for_safety:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C6CE0A1-8E88-405B-BD6D-48FCD084CB07",
              "versionEndIncluding": "1.0.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry\u00ae QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de enteros en la funci\u00f3n calloc() de la biblioteca de tiempo de ejecuci\u00f3n C de las versiones afectadas de BlackBerry\u00ae QNX Software Development Platform (SDP) versi\u00f3n(es) 6.5.0SP1 y anteriores, QNX OS for Medical versiones 1.1 y anteriores, y QNX OS for Safety versiones 1.0.1 y anteriores, que podr\u00eda permitir a un atacante llevar a cabo potencialmente una denegaci\u00f3n de servicio o ejecutar c\u00f3digo arbitrario."
    }
  ],
  "id": "CVE-2021-22156",
  "lastModified": "2025-08-22T16:15:33.777",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0,
        "source": "secure@blackberry.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-08-17T19:15:08.057",
  "references": [
    {
      "source": "secure@blackberry.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://support.blackberry.com/kb/articleDetail?articleNumber=000082334"
    },
    {
      "source": "secure@blackberry.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://support.blackberry.com/kb/articleDetail?articleNumber=000082334"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL"
    }
  ],
  "sourceIdentifier": "secure@blackberry.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "secure@blackberry.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.