CVE-2021-26706

{"id": "CVE-2021-26706", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-01-24T01:15:07.820", "references": [{"url": "https://docs.silabs.com/micrium/latest/micrium-common/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://micrium.atlassian.net/wiki/spaces/libdoc138/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker."}, {"lang": "es", "value": "Se ha detectado un problema en el archivo lib_mem.c en Micrium uC/OS uC/LIB versiones 1.38.x y 1.39.00. Las siguientes funciones de asignaci\u00f3n de memoria no comprueban el desbordamiento de enteros cuando es asignado un pool cuyo tama\u00f1o excede el espacio de direcciones: Mem_PoolCreate, Mem_DynPoolCreate y Mem_DynPoolCreateHW. Dado que estas funciones usan la multiplicaci\u00f3n para calcular el tama\u00f1o de los pools, la operaci\u00f3n puede causar un desbordamiento de enteros si los argumentos son lo suficientemente grandes. El pool de memoria resultante ser\u00e1 m\u00e1s peque\u00f1o de lo esperado y puede ser explotado por un atacante"}], "lastModified": "2022-02-17T15:43:38.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADEC04DF-BBB7-4E00-9AF1-3B52DA9256F3"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5095D618-E1AF-45DD-9922-2D3432C95D7F"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1ED2590-7E89-42A8-AC6A-961B1AE72F8D"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C968427F-019A-4935-AB46-C1B37B82F7E5"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C96AD897-3BC7-4670-B10A-F0EE7EB0BA69"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.38.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8A49CE1-1BF8-4942-8D22-241F0911203F"}, {"criteria": "cpe:2.3:a:micrium:uc\\/lib:1.39.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94FF181B-D5BC-4713-A61B-6F96D522A1CC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}