CVE-2021-22547: Buffer overrun in Google Cloud IoT Device SDK for Embedded C
In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22547?
CVE-2021-22547 has been classified as a high severity vulnerability.
How do I fix CVE-2021-22547?
To fix CVE-2021-22547, update the Google Cloud IoT Device SDK for Embedded C to version 1.0.3 or later.
What causes the vulnerability CVE-2021-22547?
CVE-2021-22547 is caused by the lack of length checks in the implementation of calloc(), allowing for potential memory corruption.
Who is affected by CVE-2021-22547?
Users of versions up to 1.0.3 of the Google Cloud IoT Device SDK for Embedded C are affected by CVE-2021-22547.
What are the potential impacts of CVE-2021-22547?
CVE-2021-22547 can lead to unauthorized access to other parts of the heap memory, potentially compromising the device.