Vulnerability · Published Dec 15, 2020 · Assigned by Google
CVE-2020-8935
Medium 5.3
In plain English
A medium-severity security flaw in Asylo from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Asylo | unspecified – through 0.6.0 |
References
- https://github.com/google/asylo/commit/ed0926bff0e423cd122a18b3d2fc772817f66825 x_refsource_CONFIRM