CVE-2021-22552: google llc asylo Buffer Over-read

Vulnerability summary

CVE-2021-22552 is a medium (CVSS 5.5) Buffer Over-read vulnerability in google llc asylo. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-08-2021
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.