CVE-2021-27421 - Vulnerability Details - OpenCVE

NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00454.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Nxp	Mcuxpresso Software Development Kit

Configuration 1 [-]

cpe:2.3:a:nxp:mcuxpresso_software_development_kit:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-14175	NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.

Fixes

Solution

Update NXP MCUXpresso SDK to 2.9.0 or later

Workaround

No workaround given by the vendor.

References

Link	Providers
https://mcuxpresso.nxp.com/en/welcome
https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04

History

Wed, 16 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-05-03T20:24:23.000Z

Updated: 2025-04-16T16:24:46.545Z

Reserved: 2021-02-19T00:00:00.000Z

Link: CVE-2021-27421

Vulnrichment

Updated: 2024-08-03T20:48:17.120Z

NVD

Status : Modified

Published: 2022-05-03T21:15:08.307

Modified: 2024-11-21T05:57:57.357

Link: CVE-2021-27421

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "MCUXpresso SDK", "vendor": "NXP", "versions": [{"lessThan": "2.8.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "value": "NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-03T20:24:23.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mcuxpresso.nxp.com/en/welcome"}], "solutions": [{"lang": "en", "value": "Update NXP MCUXpresso SDK to 2.9.0 or later "}], "source": {"defect": ["\u201cBadAlloc\u201d"], "discovery": "EXTERNAL"}, "title": "NXP MCUXpresso SDK Integer Overflow or Wraparound", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2021-27421", "STATE": "PUBLIC", "TITLE": "NXP MCUXpresso SDK Integer Overflow or Wraparound"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "MCUXpresso SDK", "version": {"version_data": [{"version_affected": "<", "version_value": "2.8.2"}]}}]}, "vendor_name": "NXP"}]}}, "credit": [{"lang": "eng", "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-190 Integer Overflow or Wraparound"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"}, {"name": "https://mcuxpresso.nxp.com/en/welcome", "refsource": "CONFIRM", "url": "https://mcuxpresso.nxp.com/en/welcome"}]}, "solution": [{"lang": "en", "value": "Update NXP MCUXpresso SDK to 2.9.0 or later "}], "source": {"defect": ["\u201cBadAlloc\u201d"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:48:17.120Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mcuxpresso.nxp.com/en/welcome"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T15:57:09.567914Z", "id": "CVE-2021-27421", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T16:24:46.545Z"}}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-27421", "datePublished": "2022-05-03T20:24:23.000Z", "dateReserved": "2021-02-19T00:00:00.000Z", "dateUpdated": "2025-04-16T16:24:46.545Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://mcuxpresso.nxp.com/en/welcome", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:48:17.120Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-27421", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T15:57:09.567914Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:57:16.509Z"}}], "cna": {"title": "NXP MCUXpresso SDK Integer Overflow or Wraparound", "source": {"defect": ["\u201cBadAlloc\u201d"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "NXP", "product": "MCUXpresso SDK", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.8.2", "versionType": "custom"}]}], "solutions": [{"lang": "en", "value": "Update NXP MCUXpresso SDK to 2.9.0 or later "}], "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://mcuxpresso.nxp.com/en/welcome", "tags": ["x_refsource_CONFIRM"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-05-03T20:24:23.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."}], "impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, "source": {"defect": ["\u201cBadAlloc\u201d"], "discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.8.2", "version_affected": "<"}]}, "product_name": "MCUXpresso SDK"}]}, "vendor_name": "NXP"}]}}, "solution": [{"lang": "en", "value": "Update NXP MCUXpresso SDK to 2.9.0 or later "}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04", "refsource": "CONFIRM"}, {"url": "https://mcuxpresso.nxp.com/en/welcome", "name": "https://mcuxpresso.nxp.com/en/welcome", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-190 Integer Overflow or Wraparound"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-27421", "STATE": "PUBLIC", "TITLE": "NXP MCUXpresso SDK Integer Overflow or Wraparound", "ASSIGNER": "ics-cert@hq.dhs.gov"}}}}, "cveMetadata": {"cveId": "CVE-2021-27421", "state": "PUBLISHED", "dateUpdated": "2025-04-16T16:24:46.545Z", "dateReserved": "2021-02-19T00:00:00.000Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2022-05-03T20:24:23.000Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nxp:mcuxpresso_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "91122B0C-A807-45EA-958A-118F0715AEAB", "versionEndExcluding": "2.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc."}, {"lang": "es", "value": "NXP MCUXpresso SDK versiones anteriores a 2.8.2, son vulnerables a un desbordamiento de enteros en la funci\u00f3n SDK_Malloc, que podr\u00eda permitir el acceso a ubicaciones de memoria fuera de los l\u00edmites de una matriz especificada, conllevando a un comportamiento no esperado, como un fallo de segmentaci\u00f3n, cuando es asignado un bloque concreto de memoria de la pila por medio de malloc"}], "id": "CVE-2021-27421", "lastModified": "2024-11-21T05:57:57.357", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-03T21:15:08.307", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Product", "Vendor Advisory"], "url": "https://mcuxpresso.nxp.com/en/welcome"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://mcuxpresso.nxp.com/en/welcome"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}