CVE-2021-3321: zephyrproject-rtos zephyr Integer Overflow to Buffer Overflow

Vulnerability summary

CVE-2021-3321 is a high (CVSS 8.8) Integer Overflow to Buffer Overflow vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-10-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99

• CWE-680Integer Overflow to Buffer OverflowThe product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.