CVE-2020-8936: Arbitrary enclave memory overwrite vulnerability in ECall ecall_restore
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgxparams and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8936?
The severity of CVE-2020-8936 is considered high due to its potential for arbitrary memory overwrite.
How do I fix CVE-2020-8936?
To fix CVE-2020-8936, upgrade to Asylo version 0.6.1 or later where the vulnerability is addressed.
What versions of Asylo are affected by CVE-2020-8936?
CVE-2020-8936 affects all versions of Asylo up to and including 0.6.0.
What types of attacks is CVE-2020-8936 vulnerable to?
CVE-2020-8936 is vulnerable to arbitrary memory overwrite attacks that can lead to exposure of sensitive data.
Who is impacted by CVE-2020-8936?
Organizations using affected versions of Google Asylo for secure enclaves are impacted by CVE-2020-8936.