GoogleCVELIST:CVE-2020-8905CVE-2020-8905 Confidential Information Disclosure vulnerability in Asylo
2.8 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
23.8%
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The ‘enc_untrusted_recvfrom’ function generates a return value which is deserialized by ‘MessageReader’, and copied into three different ‘extents’. The length of the third ‘extents’ is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length… We recommend updating Asylo to version 0.6.0 or later.
CNA Affected
[
{
"product": "Asylo",
"vendor": "Google LLC",
"versions": [
{
"lessThan": "0.6.0",
"status": "affected",
"version": "stable",
"versionType": "custom"
}
]
}
]Related
2.8 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
23.8%