Cybersecurity Alert: BlackBerry QNX RTOS C Runtime Vulnerable to BadAlloc & Remote Hacking

by

CISA announced on August 17, 2021, BlackBerry publicly disclosed that its QNX Real Time Operating System (RTOS) is affected by a BadAlloc vulnerability—CVE-2021-22156. BadAlloc is a collection of vulnerabilities affecting multiple RTOSs and supporting libraries.[1] A remote attacker could exploit CVE-2021-22156 to cause a denial-of-service condition or execute arbitrary code on affected devices.[2] BlackBerry QNX RTOS is used in a wide range of products whose compromise could result in a malicious actor gaining control of highly sensitive systems,  increasing risk to the Nation’s critical functions. Note: at this time, CISA is not aware of active exploitation of this vulnerability.

CISA strongly encourages critical infrastructure organizations and other organization developing, maintaining, supporting, or using affected QNX-based systems, to patch affected products as quickly as possible. Refer to the Mitigations section for more information about patching.

Technical Details

CVE-2021-22156 is an integer overflow vulnerability affecting the calloc() function in the C runtime library of multiple BlackBerry QNX products. Exploitation of this vulnerability could lead to a denial-of-service condition or arbitrary code execution in affected devices. To exploit this vulnerability, an attacker must have control over the parameters to a calloc() function call and the ability to control what memory is accessed after the allocation. An attacker with network access could remotely exploit this vulnerability if the vulnerable product is running and the affected device is exposed to the internet.[3]

CVE-2021-22156 is part of a collection of integer overflow vulnerabilities, known as BadAlloc, which affect a wide range of industries using Internet of Things (IoT), and operational technology (OT)/industrial control systems (ICS) devices.

All BlackBerry programs with dependency on the C runtime library are affected by this vulnerability (see table 1 for a list of affected BlackBerry QNX products). Because many affected devices include safety-critical devices, exploitation of this vulnerability could result in a malicious actor gaining control of sensitive systems, possibly leading to increased risk of damage to infrastructure or critical functions.

 
Product Affected Version
 QNX SDP  6.5.0SP1, 6.5.0,  6.4.1, 6.4.0
 QNX Momentics Development Suite  6.3.2
 QNX Momentics 6.3.0SP3, 6.3.0SP2, 6.3.0SP1, 6.3.0, 6.2.1b, 6.2.1, 6.2.1A, 6.2.0
 QNX Realtime Platform  6.1.0a, 6.1.0, 6.0.0a, 6.0.0
 QNX Cross Development Kit  6.0.0, 6.1.0
 QNX Development Kit (Self-hosted)  6.0.0, 6.1.0
 QNX Neutrino RTOS Safe Kernel  1.0
 QNX Neutrino RTOS Certified Plus  1.0
 QNX Neutrino RTOS for Medical Devices  1.0, 1.1
 QNX OS for Automotive Safety  1.0
 QNX OS for Safety  1.0, 1.0.1
 QNX Neutrino Secure Kernel  6.4.0, 6.5.0
 QNX CAR Development Platform  2.0RR

 

Mitigations

CISA strongly encourages critical infrastructure organizations and other organizations developing, maintaining, supporting, or using affected QNX-based systems to patch affected products as quickly as possible.

  • Manufacturers of products that incorporate vulnerable versions should contact BlackBerry to obtain the patch.
  • Manufacturers of products who develop unique versions of RTOS software should contact BlackBerry to obtain the patch code. Note: in some cases, manufacturers may need to develop and test their own software patches.
  • End users of safety-critical systems should contact the manufacturer of their product to obtain a patch. If a patch is available, users should apply the patch as soon as possible. If a patch is not available, users should apply the manufacturer’s recommended mitigation measures until the patch can be applied.
    • Note: installation of software updates for RTOS frequently may require taking the device out of service or to an off-site location for physical replacement of integrated memory.

BlackBerry’s Response is this:

BlackBerry investigates all reports of security vulnerabilities affecting supported products and services. A security advisory is issued once the investigation is complete and the software update is released. Installing the recommended update(s) in this advisory will help maintain the security of your BlackBerry product(s).

VULNERABILITY INFORMATION

Vulnerability Categories Vulnerability Details
CVE Identifier CVE-2021-22156
Vulnerability Type Denial of Service or arbitrary code execution
CVSS Score 9.0
Affected Product(s) This issue exists in the calloc() function in the C runtime library included with:

  • QNX SDP 6.5.0SP1 and earlier versions.
  • QNX OS for Safety versions 1.0.1 and earlier safety products compliant with IEC 61508 and/or ISO 26262.
  • QNX OS for Medical versions 1.1 and earlier safety products compliant with IEC 62304

A full list of affected QNX products and versions are available here:

https://www.qnx.com/support/knowledgebase.html?id=5015Y000001SX2z
Affected Component(s) C runtime library – All programs inherit this vulnerability if they have a dependency on the C runtime.
Non-Affected Product(s)
  • systems running QNX SDP 6.6.0 and later versions
  • systems running QNX OS for Safety 1.0.2 and later versions
  • systems running QNX OS for Medical 1.1.1 and later versions
  • systems running QNX SDP 6.5.0SP1 with Patch ID 4844 applied
  • applications that don’t use calloc() with user-defined sizes
  • systems with no external interfaces
Who Should Read This Advisory/Apply Software Update(s) Developers, administrators and project managers who develop, maintain, or support affected QNX-based systems.

Manufacturers of products which incorporate affected QNX-based systems.
Requirements for Attacker to be Successful In order to exploit this vulnerability, an attacker must have control over the parameters to a calloc() function call and the ability to control what memory is accessed after the allocation.

To remotely exploit this vulnerability, an attacker would require network access and the devices would need to have a vulnerable service running and exposed.
Impact if Requirements are met A successful attacker could exploit the integer overflow in the calloc() function for denial of service or arbitrary code execution.
Mitigation(s) Ensure that only ports and protocols used by the application using the RTOS are accessible, blocking all others.

Follow network segmentation, vulnerability scanning, and intrusion detection best practices appropriate for use of the QNX product in your cybersecurity environment to prevent malicious or unauthorized access to vulnerable devices.
Workaround(s)/Recommendation(s)
All workarounds should be considered temporary measures. BlackBerry recommends that customers install the latest update(s) to protect their systems.		 There are no known workarounds for this vulnerability.

Customers will reduce the possibility of exploitation by enabling the capability for ASLR to randomize process segment addresses. To enable ASLR, use the -mr option with procnto. Customers who are able to enable ASLR should do so.

In addition, to eliminate the likelihood of an issue occurring, integrators whose systems are based on an affected QNX product should:

  • where possible, ensure that their systems only connect to trusted isolated networks
  • avoid exposing unnecessary interfaces (e.g., telnet, ftp, qconn, etc)
  • locate system networks and remote devices behind firewalls and isolate them from the business network

BlackBerry QNX further recommends

  • if using QNX SDP 6.5.0 SP1, apply patch ID 4844 or update to QNX SDP 6.6.0 or later
  • if using QNX OS for Safety 1.0 or 1.0.1, update to QNX OS for Safety 1.0.2
  • if using QNX OS for Medical 1.0 or 1.1, apply patch ID 4846 to update to QNX OS for Medical 1.1.1
Software Update(s) The updates listed above are now available through the QNX Download Center here:

BlackBerry QNX recommends that all affected QNX SDP, QNX OS for Safety, and QNX OS for Medical customers update their QNX products at their earliest convenience.

To access these links, you must be logged in to your myQNX account.

If you have received updates through a services engagement or are not sure whether this advisory applies to your specific BlackBerry QNX products, please contact your BlackBerry QNX
support representative for assistance.
Entities who use the vulnerable product for a purpose which is regulated by law for safety or security should follow all relevant safety or security guidance from regulatory agencies as to the secure configuration of their device.

More information

Where can I read more about the security of BlackBerry products and services?
For more information on BlackBerry security visit http://www.blackberry.com/psirt.

References