PT-2020-20373 · Google · Asylo

Kang Li + 3 · Published 2020-12-15 · Updated 2021-07-21 · CVE-2020-8935

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.0

Description The issue allows an attacker to make an Ecall restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address, due to an arbitrary memory overwrite.

Recommendations Update the library to a version later than 0.6.0.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

CVE-2020-8935

Affected Products

Asylo

References · 4

• https://github.com/google/asylo/commit/ed0926bff0e423cd122a18b3d2fc772817f66825 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8935 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8935 · Vendor Advisory
• https://t.me/cvenotify/7296 · Telegram Post