Vulnerability · Published May 3, 2022 · Assigned by icscert
CVE-2021-27421NXP MCUXpresso SDK Integer Overflow or Wraparound
High 7.3
In plain English
A high-severity integer overflow in MCUXpresso SDK from NXP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NXP | MCUXpresso SDK | unspecified – before 2.8.2 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 x_refsource_CONFIRM
- https://mcuxpresso.nxp.com/en/welcome x_refsource_CONFIRM