{"id":"CVE-2021-22547","aliases":["EUVD-2021-9688","GHSA-q368-635x-gcfv"],"status":"published","title":"Buffer overrun in Google Cloud IoT Device SDK for Embedded C","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00217,"percentile":0.12269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2021-05-04T13:05:17Z","modified":"2026-10-20T14:23:28Z","products":[{"vendor":"google","product":"cloud_iot_device_sdk_for_embedded_c"},{"vendor":"google llc","product":"google cloud iot device sdk for embedded c"}],"references":[{"url":"https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/blob/master/RELEASE-NOTES.md","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/pull/119","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22547"},{"url":"https://github.com/advisories/GHSA-q368-635x-gcfv"}],"sources":{"cve":[{"id":"CVE-2021-22547","title":"Buffer overrun in Google Cloud IoT Device SDK for Embedded C","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","status":"published","published":"2021-05-04T13:05:17Z","modified":"2024-08-03T18:44:13.675Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-9688","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","status":"published","published":"2021-05-04T13:05:17Z","modified":"2024-08-03T18:44:13Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:25:02.042856Z"}],"ghsa":[{"id":"GHSA-q368-635x-gcfv","title":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An...","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","status":"published","published":"2022-05-24T17:49:26Z","modified":"2023-01-29T05:06:09Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:45:57.703827Z"}],"nvd":[{"id":"CVE-2021-22547","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","status":"published","published":"2021-05-04T13:15:07.427Z","modified":"2026-06-17T03:37:24.73Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-22547","description":"In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.","status":"published","published":"2021-05-04T13:15:07.427Z","modified":"2026-10-20T14:23:28.492574153Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"}]}}