6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.5%
On August 17, 2021, BlackBerry publicly disclosed that its QNX Real Time Operating System (RTOS) is affected by a BadAlloc vulnerability—CVE-2021-22156. BadAlloc is a collection of vulnerabilities affecting multiple RTOSs and supporting libraries.[1] A remote attacker could exploit CVE-2021-22156 to cause a denial-of-service condition or execute arbitrary code on affected devices.[2] BlackBerry QNX RTOS is used in a wide range of products whose compromise could result in a malicious actor gaining control of highly sensitive systems, increasing risk to the Nation’s critical functions. Note: at this time, CISA is not aware of active exploitation of this vulnerability.
CISA strongly encourages critical infrastructure organizations and other organization developing, maintaining, supporting, or using affected QNX-based systems, to patch affected products as quickly as possible. Refer to the Mitigations section for more information about patching.
Click here for a PDF version of this report.
CVE-2021-22156 is an integer overflow vulnerability affecting the calloc()
function in the C runtime library of multiple BlackBerry QNX products. Exploitation of this vulnerability could lead to a denial-of-service condition or arbitrary code execution in affected devices. To exploit this vulnerability, an attacker must have control over the parameters to acalloc()
function call and the ability to control what memory is accessed after the allocation. An attacker with network access could remotely exploit this vulnerability if the vulnerable product is running and the affected device is exposed to the internet.[3]
CVE-2021-22156 is part of a collection of integer overflow vulnerabilities, known as BadAlloc, which affect a wide range of industries using Internet of Things (IoT), and operational technology (OT)/industrial control systems (ICS) devices. See CISA ICS Advisory ICSA-21-119-04 and Microsoft’s BadAlloc blog post for more information.
All BlackBerry programs with dependency on the C runtime library are affected by this vulnerability (see table 1 for a list of affected BlackBerry QNX products). Because many affected devices include safety-critical devices, exploitation of this vulnerability could result in a malicious actor gaining control of sensitive systems, possibly leading to increased risk of damage to infrastructure or critical functions.
Product | Affected Version |
---|---|
QNX SDP | 6.5.0SP1, 6.5.0, 6.4.1, 6.4.0 |
QNX Momentics Development Suite | 6.3.2 |
QNX Momentics | 6.3.0SP3, 6.3.0SP2, 6.3.0SP1, 6.3.0, 6.2.1b, 6.2.1, 6.2.1A, 6.2.0 |
QNX Realtime Platform | 6.1.0a, 6.1.0, 6.0.0a, 6.0.0 |
QNX Cross Development Kit | 6.0.0, 6.1.0 |
QNX Development Kit (Self-hosted) | 6.0.0, 6.1.0 |
QNX Neutrino RTOS Safe Kernel | 1.0 |
QNX Neutrino RTOS Certified Plus | 1.0 |
QNX Neutrino RTOS for Medical Devices | 1.0, 1.1 |
QNX OS for Automotive Safety | 1.0 |
QNX OS for Safety | 1.0, 1.0.1 |
QNX Neutrino Secure Kernel | 6.4.0, 6.5.0 |
QNX CAR Development Platform | 2.0RR |
CISA strongly encourages critical infrastructure organizations and other organizations developing, maintaining, supporting, or using affected QNX-based systems to patch affected products as quickly as possible.
Critical infrastructure organizations are encouraged to review the following guidance for additional information:
[4] BlackBerry: QNX. Affected Product List
Initial version: August 17, 2021|August 18, 2021: Added links to U.S. Coast Guard and U.S. Nuclear Regulatory Commission advisories.|August 23, 2021: Added additional resource for critical infrastructure organizations
blackberry.qnx.com/en/company/about-qnx
msrc-blog.microsoft.com/2021/04/29/badalloc-memory-allocation-vulnerabilities-could-affect-wide-range-of-iot-and-ot-devices-in-industrial-medical-and-enterprise-networks/
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334
support.blackberry.com/kb/articleDetail?articleNumber=000082334%20
twitter.com/CISAgov
twitter.com/intent/tweet?text=BadAlloc%20Vulnerability%20Affecting%20BlackBerry%20QNX%20RTOS+https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-229a
us-cert.cisa.gov/ics/advisories/icsa-21-119-04
us-cert.cisa.gov/ics/advisories/icsa-21-119-04
us-cert.cisa.gov/ics/advisories/icsa-21-119-04
www.dco.uscg.mil/Portals/9/Cyber/MaritimeCyberAlert%2002-21%20TLP_WHITE.pdf
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-229a&title=BadAlloc%20Vulnerability%20Affecting%20BlackBerry%20QNX%20RTOS
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-229a
www.nrc.gov/docs/ML2121/ML21217A177.pdf
www.oig.dhs.gov/
www.qnx.com/support/knowledgebase.html?id=5015Y000001SX2z
www.qnx.com/support/knowledgebase.html?id=5015Y000001SX2z
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-229a
www.usa.gov/
www.waterisac.org/portal/joint-waterisac-%E2%80%93-us-environmental-protection-agency-advisory-badalloc-vulnerability
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=BadAlloc%20Vulnerability%20Affecting%20BlackBerry%20QNX%20RTOS&body=www.cisa.gov/news-events/cybersecurity-advisories/aa21-229a
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.5%