PT-2021-15137 · Google · Asylo

Kang Li + 4 · Published 2021-06-08 · Updated 2022-10-25 · CVE-2021-22549

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asylo versions prior to 0.6.2

Description An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory.

Recommendations For Asylo versions prior to 0.6.2, update past 0.6.2 or apply the git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-823

CWE-668

Related Identifiers

CVE-2021-22549

Affected Products

Asylo

References · 4

• https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad · Patch
• https://osv.dev/vulnerability/CVE-2021-22549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22549 · Security Note
• https://t.me/cvenotify/15853 · Telegram Post