CVE-2020-8905

The CVE-2020-8905 entry concerns Asylo before 0.6.0, where a buffer-length validation flaw in enc_untrusted_recvfrom allows an attacker to force copying trusted memory into a small untrusted buffer, enabling unauthorized data access. The issue is described as a memory-read vulnerability within Me...

CVE-2021-22550

The CVE-2021-22550 entry concerns the Google Asylo framework where an attacker can modify pointers in enclave memory to overwrite arbitrary addresses inside a secure enclave. The vulnerability is tied to UntrustedCacheMalloc::GetBuffer (as described in CVE records) and is mitigated by updating be...

CVE-2020-8904

The CVE-2020-8904 entry concerns Asylo prior to 0.6.0, where the ecall_restore function does not validate the range of the output_len pointer, allowing an attacker to manipulate tmp_output_len and overwrite arbitrary trusted (enclave) memory. Affected product: Asylo (pre-0.6.0). Impact described:...

CVE-2021-22549

CVE-2021-22549 affects Google’s Asylo framework (TrustedPrimitives::UntrustedCall). The vulnerability allows an attacker to modify an address to point to trusted memory, overwriting arbitrary trusted memory. Public details indicate exploitation is local with low attack complexity; attacker privil...

CVE-2021-22548

The CVE-2021-22548 entry concerns Google Asylo. A vulnerability arises where an attacker can change a pointer from untrusted memory to reference trusted memory, causing copying of trusted memory to trusted memory. If the later copy-out occurs, this enables reading memory regions from the trusted ...