VDB
CVE-2021-22547
CVE-2021-22547
PUBLISHED
CVSS 6.300000190734863 MEDIUM
In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.
EPSS 0.22% · 12.4th percentile
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.22%
12.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cloud_iot_device_sdk_for_embedded_c | 0 | |
| Google LLC | Google Cloud IoT Device SDK for Embedded C | unspecified |
Timeline
- May 4, 2021 CVE Published
- May 5, 2021 EPSS Score
- Jul 8, 2021 EPSS Score
- Sep 8, 2021 EPSS Score
- Nov 10, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Mar 14, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 15, 2022 EPSS Score
- Jul 17, 2022 EPSS Score
- Sep 18, 2022 EPSS Score
- Nov 19, 2022 EPSS Score