PT-2022-9788 · Micrium · Micrium Uc/Os Uc/Lib

Published 2022-01-24 · Updated 2022-02-17 · CVE-2021-26706

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micrium uC/OS uC/LIB versions 1.38.x through 1.39.00

Description An issue was discovered in the memory allocation functions Mem PoolCreate, Mem DynPoolCreate, and Mem DynPoolCreateHW in lib mem.c. These functions do not check for integer overflow when allocating a pool whose size exceeds the address space, which can cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.

Recommendations For Micrium uC/OS uC/LIB versions 1.38.x through 1.39.00, consider disabling the Mem PoolCreate, Mem DynPoolCreate, and Mem DynPoolCreateHW functions until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-26706

Affected Products

Micrium Uc/Os Uc/Lib

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26706 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26706 · Vendor Advisory
• https://docs.silabs.com/micrium/latest/micrium-common · Vendor Advisory
• https://t.me/cvenotify/26913 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-119-04 · Note
• https://micrium.atlassian.net/wiki/spaces/libdoc138 · Note