CVE-2021-22680 NXP MQX Integer Overflow or Wraparound
An integer overflow in NXP MQX memory allocation functions allows attackers to cause crashes or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22680?
CVE-2021-22680 is a high-severity vulnerability in NXP MQX, published on 3 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Weakness: CWE-190
Which versions are affected by CVE-2021-22680?
It affects 1 product.
Products include Nxp Mqx.
How do I fix CVE-2021-22680?
No fix has been published for CVE-2021-22680 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22680 being exploited?
There is no known exploitation of CVE-2021-22680 in the wild and no public exploit code.
Sources
Also known as GHSA-vg7p-p52h-xg3x.