Sign-up

ID

VAR-202111-1496


CVE

CVE-2021-43268


TITLE

Wind River VxWorks Resource Management Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2022-01699 // CNNVD: CNNVD-202111-2086

DESCRIPTION

An issue was discovered in VxWorks 6.9 through 7. In the IKE component, a specifically crafted packet may lead to reading beyond the end of a buffer, or a double free. VxWorks contains a double free vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Wind River VxWorks is an operating system of Wind River Company of the United States. The industry-leading real-time operating system for building embedded devices and systems. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2021-43268 // JVNDB: JVNDB-2021-015429 // CNVD: CNVD-2022-01699

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-01699

AFFECTED PRODUCTS

vendor:windrivermodel:vxworksscope:lteversion:7.0

Trust: 1.0

vendor:windrivermodel:vxworksscope:gteversion:6.9

Trust: 1.0

vendor:ウインドリバー株式会社model:vxworksscope:eqversion:6.9 to 7

Trust: 0.8

vendor:ウインドリバー株式会社model:vxworksscope:eqversion: -

Trust: 0.8

vendor:windmodel:river vxworksscope:gteversion:6.9,<=7.0

Trust: 0.6

sources: CNVD: CNVD-2022-01699 // JVNDB: JVNDB-2021-015429 // NVD: CVE-2021-43268

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-43268
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-43268
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-01699
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202111-2086
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2021-43268
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-01699
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-43268
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 2.5
version: 3.1

Trust: 1.0

NVD: CVE-2021-43268
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-01699 // JVNDB: JVNDB-2021-015429 // CNNVD: CNNVD-202111-2086 // NVD: CVE-2021-43268

PROBLEMTYPE DATA

problemtype:CWE-415

Trust: 1.0

problemtype:Double release (CWE-415) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-015429 // NVD: CVE-2021-43268

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-2086

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202111-2086

PATCH

title:CVE-2021-43268url:https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2021-43268

Trust: 0.8

title:Patch for Wind River VxWorks Resource Management Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/312121

Trust: 0.6

title:Wind River VxWorks Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=171991

Trust: 0.6

sources: CNVD: CNVD-2022-01699 // JVNDB: JVNDB-2021-015429 // CNNVD: CNNVD-202111-2086

EXTERNAL IDS

db:NVDid:CVE-2021-43268

Trust: 3.8

db:JVNDBid:JVNDB-2021-015429

Trust: 0.8

db:CNVDid:CNVD-2022-01699

Trust: 0.6

db:CNNVDid:CNNVD-202111-2086

Trust: 0.6

sources: CNVD: CNVD-2022-01699 // JVNDB: JVNDB-2021-015429 // CNNVD: CNNVD-202111-2086 // NVD: CVE-2021-43268

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2021-43268

Trust: 2.0

url:https://support2.windriver.com/index.php?page=cve&on=view&id=cve-2021-43268

Trust: 1.6

url:https://vigilance.fr/vulnerability/vxworks-double-free-via-ike-component-36968

Trust: 0.6

sources: CNVD: CNVD-2022-01699 // JVNDB: JVNDB-2021-015429 // CNNVD: CNNVD-202111-2086 // NVD: CVE-2021-43268

SOURCES

db:CNVDid:CNVD-2022-01699
db:JVNDBid:JVNDB-2021-015429
db:CNNVDid:CNNVD-202111-2086
db:NVDid:CVE-2021-43268

LAST UPDATE DATE

2024-11-23T22:32:59.954000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-01699date:2022-01-26T00:00:00
db:JVNDBid:JVNDB-2021-015429date:2022-11-21T05:47:00
db:CNNVDid:CNNVD-202111-2086date:2021-12-07T00:00:00
db:NVDid:CVE-2021-43268date:2024-11-21T06:28:57.507

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-01699date:2021-12-31T00:00:00
db:JVNDBid:JVNDB-2021-015429date:2022-11-21T00:00:00
db:CNNVDid:CNNVD-202111-2086date:2021-11-24T00:00:00
db:NVDid:CVE-2021-43268date:2021-11-24T17:15:08.030