CVE-2020-8944

CWE-120 — Classic Buffer OverflowCWE-787 — Out-of-bounds Write3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 95.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google LLC AsyloGoogle Asylo
Timeline
PublishedDec 15
Latest updateMay 24

Description

An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses including those within the secure enclave We recommend upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:NExploitability: 1.0 | Impact: 4.2

Affected Packages2 packages

▶NVDgoogle/asylo0.6.0
▶CVEListV5google_llc/asylounspecified — 0.6.0

🔴Vulnerability Details

2
GHSA
GHSA-mx6v-gg5x-68cf: An arbitrary memory write vulnerability in Asylo versions up to 0↗2022-05-24
▶
CVEList
Unchecked buffer overrun in ecall_restore↗2020-12-15
▶
CVE-2020-8944 (MEDIUM CVSS 5.5) | An arbitrary memory write vulnerabi | cvebase.io