PT-2021-15135 · Google · Google Cloud Iot Device Sdk For Embedded C

Published 2021-05-04 · Updated 2021-05-07 · CVE-2021-22547

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Cloud IoT Device SDK for Embedded C versions prior to 1.0.3

Description The issue is related to an implementation of calloc() that lacks a length check. This allows an attacker to pass in memory objects larger than the buffer, potentially wrapping around to access smaller buffers than required, and gain access to other parts of the heap.

Recommendations For versions prior to 1.0.3, upgrade the Google Cloud IoT Device SDK for Embedded C to version 1.0.3 or greater.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-22547

Affected Products

Google Cloud Iot Device Sdk For Embedded C

References · 6

• https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/pull/119 · Patch
• https://osv.dev/vulnerability/CVE-2021-22547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22547 · Security Note
• https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/blob/master/RELEASE-NOTES.md · Note
• https://t.me/cvenotify/14021 · Telegram Post
• https://t.me/cvenotify/14001 · Telegram Post