A major vulnerability affecting older versions of BlackBerry’s
QNX Real-Time Operating System (RTOS) could allow malicious actors
to cripple and gain control of a variety of products, including
cars, medical, and industrial equipment.
The shortcoming (CVE-2021-22156, CVSS score: 9.0) is part of a
broader collection of flaws, collectively dubbed BadAlloc[1], that was originally
disclosed by Microsoft in April 2021, which could open a backdoor
into many of these devices, allowing attackers to commandeer them
or disrupt their operations.
“A remote attacker could exploit CVE-2021-22156 to cause a
denial-of-service condition or execute arbitrary code on affected
devices,” the U.S. Cybersecurity and Infrastructure Security Agency
(CISA) said[2]
in a Tuesday bulletin. As of writing, there is no evidence of
active exploitation of the vulnerability.
BlackBerry QNX technology is used[3]
worldwide by over 195 million vehicles and embedded systems across
a wide range of industries, including aerospace and defense,
automotive, commercial vehicles, heavy machinery, industrial
controls, medical, rail, and robotics.
BlackBerry, in an independent advisory, characterized the issue
as “an integer overflow vulnerability in the calloc() function of
the C runtime library” affecting its QNX Software Development
Platform (SDP) version 6.5.0SP1 and earlier, QNX OS for Medical 1.1
and earlier, and QNX OS for Safety 1.0.1. Manufacturers of IoT and
OT devices that incorporate affected QNX-based systems are advised
to apply the following patches –
- QNX SDP 6.5.0 SP1 – Apply patch ID 4844 or
update to QNX SDP 6.6.0 or later - QNX OS for Safety 1.0 or 1.0.1 – Update to QNX
OS for Safety 1.0.2, and - QNX OS for Medical 1.0 or 1.1 – Apply patch ID
4846 to update to QNX OS for Medical 1.1.1
“Ensure that only ports and protocols used by the application
using the RTOS are accessible, blocking all others,” BlackBerry
suggested[4]
as mitigations. “Follow network segmentation, vulnerability
scanning, and intrusion detection best practices appropriate for
use of the QNX product in your cybersecurity environment to prevent
malicious or unauthorized access to vulnerable devices.”
In a separate report, Politico revealed[5]
that BlackBerry resisted efforts to publicly announce[6]
the BadAlloc vulnerability in late April, citing people familiar
with the matter, instead planned to privately contact its customers
and warn them about the issue — an approach that could have put
several device manufacturers at risk, as the company couldn’t
identify all of the vendors using its software.
“BlackBerry representatives told CISA earlier this year that
they didn’t believe BadAlloc had impacted their products, even
though CISA had concluded that it did,” the report said, adding
“over the last few months, CISA pushed BlackBerry to accept the bad
news, eventually getting them to acknowledge the vulnerability
existed.”