Vulnerability · Published May 3, 2022 · Assigned by icscert
CVE-2021-27411Micrium OS Integer Overflow or Wraparound
Medium 6.5
In plain English
A medium-severity integer overflow in Micrium OS from Micrium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.9%top 40.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Micrium | Micrium OS | unspecified – through 5.10.1 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 x_refsource_CONFIRM
- https://www.silabs.com/developers/micrium-os x_refsource_CONFIRM