CVE-2021-27429 (GCVE-0-2021-27429)

Vulnerability from cvelistv5 – Published: 2023-11-20 19:00 – Updated: 2024-08-03 20:48
VLAI
Title
Texas Instruments TI-RTOS Integer Overflow or Wraparound
Summary
Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.
Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Credits
David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:48:17.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink MSP432E4XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC13XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC26XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.40.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SimpleLink-CC32XX",
          "vendor": "Texas Instruments",
          "versions": [
            {
              "lessThan": "4.10.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T19:00:19.757Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
        },
        {
          "url": "https://www.ti.com/tool/TI-RTOS-MCU"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eTexas Instruments CC32XX \u2013 Update to v4.40.00.07\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X0 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.10.03\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC13X2-CC26X2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink CC2640R2 \u2013 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html\"\u003eUpdate to v4.40.00\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003eTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\u003c/div\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Texas Instruments CC32XX \u2013 Update to v4.40.00.07\n\nTexas Instruments SimpleLink CC13X0 \u2013  Update to v4.10.03 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC13X2-CC26X2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink CC2640R2 \u2013  Update to v4.40.00 https://www.ti.com/technologies/security/report-product-security-vulnerabilities.html \n\nTexas Instruments SimpleLink MSP432E4 \u2013 Confirmed. No update currently planned\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Texas Instruments TI-RTOS Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-27429",
    "datePublished": "2023-11-20T19:00:19.757Z",
    "dateReserved": "2021-02-19T17:45:42.315Z",
    "dateUpdated": "2024-08-03T20:48:17.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-27429",
      "date": "2026-10-02",
      "epss": "0.00276",
      "percentile": "0.18185"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "CC32XX",
                "vendor": "Texas Instruments",
                "versions": [
                  {
                    "lessThan": "4.40.00.07",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SimpleLink MSP432E4XX",
                "vendor": "Texas Instruments",
                "versions": [
                  {
                    "status": "affected",
                    "version": "all versions"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SimpleLink-CC13XX",
                "vendor": "Texas Instruments",
                "versions": [
                  {
                    "lessThan": "4.40.00",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SimpleLink-CC26XX",
                "vendor": "Texas Instruments",
                "versions": [
                  {
                    "lessThan": "4.40.00",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SimpleLink-CC32XX",
                "vendor": "Texas Instruments",
                "versions": [
                  {
                    "lessThan": "4.10.03",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "ics-cert@hq.dhs.gov"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:ti:real-time_operating_system:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E289611E-871B-433E-BF10-CDABF650AAC9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:ti:cc3200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1738237-A64A-40A3-B201-7E0005CCA3A2",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3220r:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D436F6E3-B044-457E-B67D-9C76105F0847",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3220s:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EE6E103B-F34A-477C-907D-B4EAE295D90E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3220sf:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "71ABA01C-4CB1-4DD5-9263-79A58BED3A9B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3230s:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E34FD25E-D5C2-40F0-81E2-A8A102934E8C",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3230sf:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3408EEBE-25EC-4CEA-8E96-DCFF7C66B3F6",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3235s:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "370E65A3-17A4-4E05-BB4A-6C09BB5249CA",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:ti:cc3235sf:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B06F9E6A-690D-4E95-ADD4-927995EE5523",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "97B4CA27-1024-4347-8C0B-A8848950CB5B",
                    "versionEndExcluding": "4.40.00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BCC0C102-7DCB-4959-91C6-ECA8429BB1A2",
                    "versionEndExcluding": "4.40.00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "61CF4AB1-347E-42F9-89FB-350445ED7E70",
                    "versionEndExcluding": "4.10.03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "538BC9EE-7C51-41CC-9A58-5FEB3261EF7C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EC7C493D-DAC1-4FBD-A056-C9D5CF98F9E0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "\nTexas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in \u0027HeapTrack_alloc\u0027 and result in code execution. \n\n"
          },
          {
            "lang": "es",
            "value": "Texas Instruments TI-RTOS devuelve un puntero v\u00e1lido a un b\u00fafer peque\u00f1o en valores extremadamente grandes. Esto puede desencadenar una vulnerabilidad de desbordamiento de enteros en \u0027HeapTrack_alloc\u0027 y provocar la ejecuci\u00f3n de c\u00f3digo."
          }
        ],
        "id": "CVE-2021-27429",
        "lastModified": "2026-06-17T03:44:50.700",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.4,
              "impactScore": 5.9,
              "source": "ics-cert@hq.dhs.gov",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-11-20T19:15:08.357",
        "references": [
          {
            "source": "ics-cert@hq.dhs.gov",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "source": "ics-cert@hq.dhs.gov",
            "tags": [
              "Product"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product"
            ],
            "url": "https://www.ti.com/tool/TI-RTOS-MCU"
          }
        ],
        "sourceIdentifier": "ics-cert@hq.dhs.gov",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "ics-cert@hq.dhs.gov",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.