PT-2020-20375 · Google · Asylo

Kang Li + 3 · Published 2020-12-15 · Updated 2020-12-17 · CVE-2020-8937

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.0

Description An arbitrary memory overwrite issue allows an attacker to make a host call to enc untrusted create wait queue that uses a pointer queue relying on UntrustedLocalMemcpy, which fails to validate the pointer location. This enables an attacker to write memory values from within the enclave.

Recommendations For Asylo versions up to 0.6.0, upgrade past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 to resolve the issue. As a temporary workaround, consider restricting access to the enc untrusted create wait queue function and the UntrustedLocalMemcpy until a patch is available.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

CVE-2020-8937

Affected Products

Asylo

References · 5

• https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02 · Patch
• https://osv.dev/vulnerability/CVE-2020-8937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8937 · Security Note
• https://t.me/cvenotify/7224 · Telegram Post
• https://t.me/cibsecurity/20817 · Telegram Post