Vulnerability · Published Aug 17, 2021 · Assigned by blackberry

CVE-2021-22156

Critical 9.0

In plain English

A critical-severity integer overflow in QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety from BlackBerry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)1.8%top 21.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.

Affected products (as reported)

Vendor	Product	Versions
BlackBerry	QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety	QNX SDP 6.5.0 SP1 and earlierQNX OS for Medical 1.1 and earlierQNX OS for Safety 1.0.1 and earlier

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://support.blackberry.com/kb/articleDetail?articleNumber=000082334 x_refsource_MISC
20210818 BlackBerry QNX-2021-001 Vulnerability Affecting Cisco Products: August 2021 vendor-advisory, x_refsource_CISCO