PT-2020-20374 · Google · Asylo

Kang Li + 3 · Published 2020-12-15 · Updated 2020-12-18 · CVE-2020-8936

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.0

Description An arbitrary memory overwrite issue allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

Recommendations For Asylo versions up to 0.6.0, update to a version later than 0.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the UntrustedCall function to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-8936

Affected Products

Asylo

References · 5

• https://github.com/google/asylo/commit/83036fd841d33baa7e039f842d131aa7881fdcc2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8936 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8936 · Vendor Advisory
• https://t.me/cibsecurity/20811 · Telegram Post
• https://t.me/cvenotify/7297 · Telegram Post