CVE-2020-8936: google llc asylo Out-of-bounds Read

Vulnerability summary

CVE-2020-8936 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in google llc asylo. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.

Timeline

1. 15-12-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.