CVE-2021-22547

In IoT Devices SDK, there is an implementation of calloc that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading th...

CVE-2021-22547

CVE-2021-22547 affects the Google Cloud IoT Device SDK for Embedded C (IoT Devices SDK). The root cause is a calloc() implementation without a length check, which can allow an attacker to provide memory objects larger than the buffer and wrap around to create a smaller buffer, enabling access to ...