CVE-2021-27431

highPriorität · verfolgen · 39EPSS 0.011 · 67. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.15% (67th) EPSS

CVSS 7.5 · high

Is it mine?

58 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-27

ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationARM CMSIS-RTOS2cisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationARM Mbed OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationARM mbed-ualloccisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationAmazon FreeRTOScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationApache Nuttx OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationBlackBerry QNX OS for Medicalcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationBlackBerry QNX OS for Safetycisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationBlackBerry QNX SDPcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationCesanta Software Mongoose OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationGoogle Cloud IoT Device SDKcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationMedia Tek LinkIt SDKcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationMicrium OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationMicrium uC/OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationNXP MCUXpresso SDKcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationNXP MQXcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationRIOT OScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationRedhat newlibcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationSamsung Tizen RT RTOScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTencentOS-tinycisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTexas Instruments CC32XXcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTexas Instruments SimpleLinkcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTexas Instruments SimpleLink-CC13XXcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTexas Instruments SimpleLink-CC26XXcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationTexas Instruments SimpleLink-CC32XXcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationUclibc-NGcisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationWindriver VxWorkscisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationZephyr Project RTOScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr
MitigationeCosCentric eCosPro RTOScisa_csaf_ot
Zephyr Project: Update to 2.5 or later. Patches available for prior supported versions. See the Zephyr security advisory for more information.
https://github.com/zephyrproject-rtos/zephyr

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.3–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.07.3highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · CISA US

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ics-cert@hq.dhs.gov USAusnutzbarkeit 3.9 · Auswirkung 3.4

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-190USCWE-190US

betroffene Produkte (58)

Betroffene Produkte und Versionsbereiche.

ARM CMSIS-RTOS2: versions prior to 2.1.3alle Versionencisa_csaf_otUS
ARM Mbed OS: Version 6.3.0alle Versionencisa_csaf_otUS
ARM mbed-ualloc: Version 1.3.0alle Versionencisa_csaf_otUS
Amazon FreeRTOS: Version 10.4.1alle Versionencisa_csaf_otUS
Apache Nuttx OS: Version 9.1.0alle Versionencisa_csaf_otUS
BlackBerry QNX OS for Medical: Versions 1.1 and earlier safety products compliant with IEC 62304alle Versionencisa_csaf_otUS
BlackBerry QNX OS for Safety: Versions 1.0.1 and earlier safety products compliant with IEC 61508 and/or ISO 26262alle Versionencisa_csaf_otUS
BlackBerry QNX SDP: Versions 6.5.0 SP1 and earlieralle Versionencisa_csaf_otUS
Cesanta Software Mongoose OS: v2.17.0alle Versionencisa_csaf_otUS
Google Cloud IoT Device SDK: Version 1.0.2alle Versionencisa_csaf_otUS
Media Tek LinkIt SDK: versions prior to 4.6.1alle Versionencisa_csaf_otUS
Micrium OS: Versions 5.10.1 and prioralle Versionencisa_csaf_otUS
Micrium uC/OS: uC/LIB Versions 1.38.xx Version 1.39.00alle Versionencisa_csaf_otUS
NXP MCUXpresso SDK: versions prior to 2.8.2alle Versionencisa_csaf_otUS
NXP MQX: Versions 5.1 and prioralle Versionencisa_csaf_otUS
RIOT OS: Version 2020.01.1alle Versionencisa_csaf_otUS
Redhat newlib: versions prior to 4.0.0alle Versionencisa_csaf_otUS
Samsung Tizen RT RTOS: versions prior 3.0.GBBalle Versionencisa_csaf_otUS
TencentOS-tiny: Version 3.1.0alle Versionencisa_csaf_otUS
Texas Instruments CC32XX: versions prior to 4.40.00.07alle Versionencisa_csaf_otUS

20 von 58 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-21-119-04Multiple RTOS (Update E)2021-04-29icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in unexpected behavior such as a crash or a remote code injection/execution.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2022-05-03geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan