CVE-2021-22547

Name of the Vulnerable Software and Affected Versions Google Cloud IoT Device SDK for Embedded C versions prior to 1.0.3

Description The issue is related to an implementation of calloc() that lacks a length check. This allows an attacker to pass in memory objects larger than the buffer, potentially wrapping around to access smaller buffers than required, and gain access to other parts of the heap.

Recommendations For versions prior to 1.0.3, upgrade the Google Cloud IoT Device SDK for Embedded C to version 1.0.3 or greater.