PT-2020-20376 · Google · Asylo

Kang Li + 3 · Published 2020-12-15 · Updated 2020-12-17 · CVE-2020-8938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.0

Description An arbitrary memory overwrite issue allows an attacker to make a host call to FromkLinuxSockAddr with attacker-controlled content and size of klinux addr, enabling the attacker to write memory values from within the enclave.

Recommendations For Asylo versions up to 0.6.0, upgrade past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-8938

Affected Products

Asylo

References · 4

• https://github.com/google/asylo/commit/bda9772e7872b0d2b9bee32930cf7a4983837b39 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8938 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8938 · Vendor Advisory
• https://t.me/cvenotify/7232 · Telegram Post