CVE-2021-27417
Summary
| CVE | CVE-2021-27417 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-03 21:15:00 UTC |
| Updated | 2022-05-12 15:38:00 UTC |
| Description | eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. |
Risk And Classification
Problem Types: CWE-190
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ecoscentric | Ecospro | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Multiple RTOS (Update D) | CISA | CONFIRM | www.cisa.gov | |
| Log in to The Issue Management System | CONFIRM | bugzilla.ecoscentric.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.
There are currently no legacy QID mappings associated with this CVE.