6.4
Medium
CVE-2020-8904 An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0
Description
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Asylo 0.6 | earliest → < 0.6.0 | 0.6.0 |
Other CVEs of Asylo
The 16 CVEs of Asylo →
CVE-2021-22552
An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall…
5.3
Medium
CVE-2021-22550
An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave
6.5
Medium
CVE-2021-22549
An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory
6.5
Medium
CVE-2021-22548
An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted…
6.5
Medium