CVE-2021-27417 eCosCentric eCosPro RTOS Integer Overflow or Wraparound
An integer overflow in the calloc function allows arbitrary memory allocation, leading to heap-based buffer overflows and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-27417?
CVE-2021-27417 is a medium-severity vulnerability in eCosCentric eCosPro RTOS, published on 3 May 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2021-27417?
It affects 1 product.
Products include Ecoscentric Ecospro.
How do I fix CVE-2021-27417?
No fix has been published for CVE-2021-27417 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27417 being exploited?
There is no known exploitation of CVE-2021-27417 in the wild and no public exploit code.
Sources
Also known as GHSA-6gcq-2grw-gh92.