PT-2021-3887 · Blackberry · Blackberry Qnx Os For Medical+2

Published 2021-08-17 · Updated 2025-08-22 · CVE-2021-22156

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlackBerry QNX Software Development Platform (SDP) versions 6.5.0SP1 and earlier BlackBerry QNX OS for Medical versions 1.1 and earlier BlackBerry QNX OS for Safety versions 1.0.1 and earlier

Description The issue is related to an integer overflow vulnerability in the calloc() function of the C runtime library. This vulnerability could allow a remote attacker to potentially perform a denial of service or execute arbitrary code on affected devices. The vulnerability affects over 200 million vehicles and thousands of industrial control systems in various strategic industries, including medicine and others. Although there is no confirmed active exploitation of this vulnerability, there is concern that it could be exploited, leading to significant consequences.

Recommendations For BlackBerry QNX Software Development Platform (SDP) versions 6.5.0SP1 and earlier: Update to a version that includes the fix for the integer overflow vulnerability in the calloc() function. For BlackBerry QNX OS for Medical versions 1.1 and earlier: Update to a version that includes the fix for the integer overflow vulnerability in the calloc() function. For BlackBerry QNX OS for Safety versions 1.0.1 and earlier: Update to a version that includes the fix for the integer overflow vulnerability in the calloc() function. As a temporary workaround, consider restricting access to the calloc() function until a patch is available. Note: According to BlackBerry, there are no workarounds for this vulnerability, but users can reduce the possibility of an attack by following the recommended measures and local updates.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2021-04268

CVE-2021-22156

Affected Products

Blackberry Qnx Os For Medical

Blackberry Qnx Os For Safety

Blackberry Qnx Software Development Platform

References · 10

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22156 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04268 · Security Note
• https://support.blackberry.com/kb/articleDetail?articleNumber=000082334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22156 · Security Note
• https://t.me/cveNotify/133191 · Telegram Post
• https://t.me/cibsecurity/27450 · Telegram Post
• https://t.me/cvenotify/19541 · Telegram Post
• https://t.me/s_e_reborn/883 · Telegram Post
• https://t.me/true_secator/2014 · Telegram Post