PT-2021-15139 · Google · Asylo

Kang Li + 3 · Published 2021-08-02 · Updated 2021-08-10 · CVE-2021-22552

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.1

Description The issue allows an untrusted attacker to bypass validation by passing a syscall number in MessageReader that is then used by sysno(), potentially enabling the attacker to read memory from within the secure enclave.

Recommendations Update to Asylo 0.6.3 or later to resolve the issue.

Exploit

Fix

Buffer Over-read

Out of bounds Read

Weakness Enumeration

CWE-126

CWE-125

Related Identifiers

CVE-2021-22552

Affected Products

Asylo

References · 3

• 🔥 https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a · Exploit
• https://osv.dev/vulnerability/CVE-2021-22552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22552 · Security Note