Vulnerability · Published Aug 12, 2020 · Assigned by Google
CVE-2020-8904Arbitrary trusted memory overwrite vulnerability in Asylo
Medium 6.4
In plain English
A medium-severity security flaw in Asylo from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Asylo | stable – before 0.6.0 |
Weakness: CWE-823 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H
References
- https://github.com/google/asylo/commit/e582f36ac49ee11a21d23ad6a30c333092e0a94e x_refsource_CONFIRM