PT-2020-14291 · Microsoft · Open Enclave

Kang Li + 3 · Published 2020-10-14 · Updated 2021-11-18 · CVE-2020-15224

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Enclave versions prior to 0.12.0

Description An information disclosure issue exists when an enclave application using the syscalls provided by the sockets.edl is loaded by a malicious host application. This could allow an attacker to read privileged data from the enclave heap across trust boundaries. To exploit this, an attacker would have to log on to an affected system and run a specially crafted application. The issue does not allow an attacker to elevate user rights directly but could be used to obtain confidential information in an enclave, potentially used in further compromises.

Recommendations For versions prior to 0.12.0, users need to recompile their applications against the patched libraries to be protected from this issue. As a temporary workaround, consider restricting the use of the sockets.edl syscalls in enclave applications until the patched libraries are applied.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2020-15224

GHSA-525H-WXCC-F66M

Affected Products

Open Enclave

References · 6

• https://github.com/openenclave/openenclave/commit/bcac8e7acb514429fee9e0b5d0c7a0308fd4d76b · Patch
• https://osv.dev/vulnerability/CVE-2020-15224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15224 · Security Note
• https://github.com/openenclave/openenclave/blob/master/CHANGELOG.md#v0120 · Note
• https://github.com/openenclave/openenclave/security/advisories/GHSA-525h-wxcc-f66m · Note
• https://t.me/cibsecurity/15272 · Telegram Post