CVE-2020-8904: Arbitrary trusted memory overwrite vulnerability in Asylo
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecallrestore function fails to validate the range of the outputlen pointer, an attacker can manipulate the tmpoutputlen value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8904?
CVE-2020-8904 has a high severity rating due to the potential for arbitrary memory overwrite by an attacker.
How do I fix CVE-2020-8904?
To fix CVE-2020-8904, upgrade Google Asylo to version 0.6.0 or later.
What versions are affected by CVE-2020-8904?
CVE-2020-8904 affects all versions of Google Asylo prior to 0.6.0.
What type of vulnerability is CVE-2020-8904?
CVE-2020-8904 is classified as an arbitrary memory overwrite vulnerability.
What could an attacker achieve by exploiting CVE-2020-8904?
By exploiting CVE-2020-8904, an attacker could potentially manipulate memory to execute code or crash the application.