CVE-2020-8938 — Out-of-bounds Write in LLC Asylo

CWE-787 — Out-of-bounds Write3 documents3 sources
Severity
3.3LOWNVD
CNA5.3
EPSS
0.0%
top 87.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google LLC AsyloGoogle Asylo
Timeline
PublishedDec 15
Latest updateMay 24

Description

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to FromkLinuxSockAddr with attacker controlled content and size of klinux_addr which allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶NVDgoogle/asylo0.6.0
▶CVEListV5google_llc/asylounspecified — 0.6.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-74pw-fvg5-f337: An arbitrary memory overwrite vulnerability in Asylo versions up to 0↗2022-05-24
▶
CVEList
Arbitrary enclave memory location write from untrusted environment↗2020-12-15
▶
CVE-2020-8938 — Out-of-bounds Write in Google LLC Asylo | cvebase