PT-2022-9810 · Ecoscentric · Ecospro Rtos

Published 2022-05-03 · Updated 2022-05-12 · CVE-2021-27417

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eCosCentric eCosPro RTOS versions 2.0.1 through 4.5.3

Description The issue concerns an integer wraparound in the calloc function, which is an implementation of malloc. This can lead to unverified memory assignment, resulting in arbitrary memory allocation and a heap-based buffer overflow.

Recommendations For versions 2.0.1 through 4.5.3, consider disabling the calloc function until a patch is available to prevent potential heap-based buffer overflows. Restrict memory allocation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-27417

Affected Products

Ecospro Rtos

References · 5

• https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27417 · Security Note
• https://t.me/cvenotify/29657 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-119-04 · Note