Vulnerability · Published Aug 12, 2020 · Assigned by Google

CVE-2020-8905Confidential Information Disclosure vulnerability in Asylo

Low 2.8

In plain English

A low-severity buffer overflow in Asylo from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)2.8Low

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.

Affected products (as reported)

Vendor	Product	Versions
Google LLC	Asylo	stable – before 0.6.0

Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93 x_refsource_CONFIRM