{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "RIOT OS version 2020.01.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC32XX versions ant\u00e9rieures \u00e0 4.10.03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Media Tek LinkIt SDK versions ant\u00e9rieures \u00e0 4.6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NXP MCUXpresso SDK versions ant\u00e9rieures \u00e0 2.8.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink MSP432E4XX",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Windriver VxWorks versions ant\u00e9rieures \u00e0 7.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Micrium OS, versions ant\u00e9rieures \u00e0 5.10.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC13XX versions ant\u00e9rieures \u00e0 4.40.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM CMSIS-RTOS2 versions ant\u00e9rieures \u00e0 2.1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Micrium uC/OS: uC/LIB versions ant\u00e9rieures \u00e0 1.39.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC26XX versions ant\u00e9rieures \u00e0 4.40.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NXP MQX versions ant\u00e9rieures \u00e0 5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM Mbed OS version 6.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TencentOS-tiny, version 3.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments CC32XX versions ant\u00e9rieures \u00e0 4.40.00.07",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Redhat newlib versions ant\u00e9rieures \u00e0 4.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX SDP versions ant\u00e9rieures \u00e0 6.5.0SP1 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX OS for Safety versions ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM mbed-ualloc version 1.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Nuttx OS version 9.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Uclibc-NG versions ant\u00e9rieures \u00e0 1.0.36",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Amazon FreeRTOS version 10.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX OS for Medical versions ant\u00e9rieures \u00e0 1.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Linux Zephyr RTOS versions ant\u00e9rieures \u00e0 2.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Zephyr Project RTOS versions ant\u00e9rieures \u00e0 2.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "eCosCentric eCosPro RTOS versions 2.0.1 \u00e0 4.5.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Samsung Tizen RT RTOS versions ant\u00e9rieures \u00e0 3.0.GBB",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Cesanta Software Mongoose OS version 2.17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Google Cloud IoT Device SDK version 1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Google",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\n-   Les int\u00e9grateurs de ces RTOS sont invit\u00e9s \u00e0 prendre contact\n    rapidement avec l\u2019\u00e9diteur du produit affect\u00e9 afin de corriger leurs\n    propres solutions et diffuser le correctif\u00a0;\n-   Les utilisateurs d\u2019\u00e9quipements bas\u00e9s sur ces RTOS sont invit\u00e9s \u00e0\n    prendre contact avec le fournisseur afin de mettre \u00e0 jour les\n    \u00e9quipements affect\u00e9s\u00a0;\n-   Il convient en outre d\u2019appliquer les bonnes pratiques r\u00e9f\u00e9renc\u00e9es\n    dans le guide ANSSI \\[1\\] et notamment celles ci-apr\u00e8s.\n    -   S\u2019assurer que les appareils concern\u00e9s ne sont pas accessibles\n        depuis Internet.\n    -   S\u2019assurer que les syst\u00e8mes ne se connectent qu\u0027\u00e0 des r\u00e9seaux ou\n        sous-r\u00e9seaux isol\u00e9s de confiance. Adopter une d\u00e9marche de\n        d\u00e9fense en profondeur permet de se prot\u00e9ger contre des menaces\n        qui ne sont pas encore connues, de diminuer le p\u00e9rim\u00e8tre sur\n        lequel une menace est exerc\u00e9e ou d\u2019en att\u00e9nuer l\u2019impact. Le\n        simple cloisonnement des r\u00e9seaux par des pare-feux ne suffit\n        pas. D\u2019autres m\u00e9canismes doivent l\u2019accompagner et \u00e0 diff\u00e9rents\n        niveaux (contr\u00f4le d\u2019acc\u00e8s physique, durcissement des\n        configurations, protection antivirale...).\n    -   Inclure des m\u00e9canismes de d\u00e9tection et de surveillance des\n        installations. Surveiller de fa\u00e7on permanente les appareils \u00e0 la\n        recherche de comportements anormaux ou non autoris\u00e9s tels que la\n        communication avec des h\u00f4tes locaux ou distants inconnus. Enfin\n        la collecte des informations au travers des journaux d\u2019alarmes\n        et d\u2019\u00e9v\u00e9nements est indispensable aux analyses ult\u00e9rieures. Ces\n        journaux pourront dans certains cas apporter des \u00e9l\u00e9ments utiles\n        et des preuves dans le cadre d\u2019une enqu\u00eate judiciaire.\n    -   R\u00e9duire la surface d\u0027attaque en \u00e9liminant les services sans\n        utilit\u00e9 fonctionnelle ou non s\u00e9curis\u00e9s.\n\n\\[1\\] Guide de l\u0027ANSSI sur la s\u00e9curit\u00e9 industrielle :\n\u003chttps://www.ssi.gouv.fr/uploads/IMG/pdf/Guide_securite_industrielle_Version_finale.pdf\u003e\n",
  "cves": [
    {
      "name": "CVE-2021-27502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27502"
    },
    {
      "name": "CVE-2021-27504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27504"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-31572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31572"
    },
    {
      "name": "CVE-2021-22684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22684"
    },
    {
      "name": "CVE-2021-22680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22680"
    },
    {
      "name": "CVE-2021-26461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26461"
    },
    {
      "name": "CVE-2021-27431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27431"
    },
    {
      "name": "CVE-2021-31571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31571"
    },
    {
      "name": "CVE-2021-22156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22156"
    },
    {
      "name": "CVE-2021-26706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26706"
    },
    {
      "name": "CVE-2021-27419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27419"
    },
    {
      "name": "CVE-2021-22636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22636"
    },
    {
      "name": "CVE-2021-27429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27429"
    },
    {
      "name": "CVE-2021-27433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27433"
    },
    {
      "name": "CVE-2021-27421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27421"
    },
    {
      "name": "CVE-2021-27425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27425"
    },
    {
      "name": "CVE-2021-27417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27417"
    },
    {
      "name": "CVE-2021-3420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3420"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-27427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27427"
    },
    {
      "name": "CVE-2021-27439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27439"
    },
    {
      "name": "CVE-2020-13603",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13603"
    },
    {
      "name": "CVE-2021-30636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-30636"
    },
    {
      "name": "CVE-2021-27435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27435"
    },
    {
      "name": "CVE-2021-27411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27411"
    }
  ],
  "initial_release_date": "2021-08-18T00:00:00",
  "last_revision_date": "2021-08-18T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 BadAlloc icsa-21-119-04 du 20 mai 2021, mis \u00e0 jour le 17 ao\u00fbt 2021",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04"
    }
  ],
  "reference": "CERTFR-2021-AVI-639",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-08-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les syst\u00e8mes\nd\u0027exploitation temps r\u00e9el (*RTOS, Real Time OS*). Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\nd\u00e9ni de service \u00e0 distance.\n\nCette famille de vuln\u00e9rabilit\u00e9s dans les *RTOS* a \u00e9t\u00e9 d\u00e9couverte,\nd\u00e9crite puis nomm\u00e9e \u00ab\u00a0BadAlloc\u00a0\u00bb par Microsoft, appellation donn\u00e9e en\nraison de l\u2019absence de v\u00e9rification des entr\u00e9es dans l\u2019allocateur\nm\u00e9moire de tas. Ces vuln\u00e9rabilit\u00e9s d\u0027ex\u00e9cution de code \u00e0 distance (RCE)\nsont r\u00e9f\u00e9renc\u00e9es par 26 CVEs et affectent potentiellement un large\n\u00e9ventail de domaines, de l\u0027IoT grand public et m\u00e9dical \u00e0 l\u0027IoT\nindustriel, aux technologies op\u00e9rationnelles (OT) et aux syst\u00e8mes de\ncontr\u00f4le industriel. Une dizaine d\u2019\u00e9diteurs sont concern\u00e9s.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans des syst\u00e8mes d\u0027exploitation temps r\u00e9el",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat newlib du 17 novembre 2020",
      "url": "https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=aa106b29a6a8a1b0df9e334704292cbc32f2d44e"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ARM CMSIS RTOS2 du 24 juin 2021",
      "url": "https://www.keil.com/pack/doc/CMSIS/RTOS2/html/rtos_revisionHistory.html"
    },
    {
      "published_at": null,
      "title": "\ufeffBulletin de s\u00e9curit\u00e9 BadAlloc icsa-21-119-04 du 20 mai 2021",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ARM mbed du 22 mars 2021",
      "url": "https://github.com/ARMmbed/mbed-os/pull/14408"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zephyr Project RTOS du 23 mars 2021",
      "url": "https://github.com/zephyrproject-rtos/zephyr/pull/31796"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Wind River VxWorks 20210319 du 19 mars 2021",
      "url": "https://support2.windriver.com/index.php?page=security-notices\u0026on=view\u0026id=7048"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Wind River VxWorks 20210203 du 03 f\u00e9vrier 2021",
      "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2020-28895"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 eCosCentric eCosPro RTOS 1002437 du 16 ao\u00fbt 2021",
      "url": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FreeRTOS du 07 d\u00e9cembre 2020",
      "url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/pull/224"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 BlackBerry du 17 ao\u00fbt 2021",
      "url": "https://support.blackberry.com/kb/articleDetail?articleNumber=000082334\u0026language=en_US"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Nuttx OS du 21 juin 2021",
      "url": "https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Texas Instruments TI-PSIRT-2020-100074 du 29 avril 2021",
      "url": "https://www.ti.com/lit/an/swra709/swra709.pdf?ts=1629129702198"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Google Cloud IoT Device du 12 avril 2021",
      "url": "https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/pull/119/files"
    }
  ]
}