Kang Li

The issue allows an untrusted attacker to bypass validation by passing a syscall number in `MessageReader` that is then used by `sysno()`, potentially enabling the attacker to read memory from within the secure enclave.

An attacker can change the pointer to untrusted memory to point to a trusted memory region, causing copying of trusted memory to trusted memory. If the latter is later copied out, it allows for reading of memory regions from the trusted region.

An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave.

An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory.

An arbitrary memory overwrite issue allows an attacker to make a host call to `FromkLinuxSockAddr` with attacker-controlled content and size of `klinux addr`, enabling the attacker to write memory values from within the enclave.

An arbitrary memory overwrite issue allows an attacker to make a host call to `enc untrusted create wait queue` that uses a pointer queue relying on `UntrustedLocalMemcpy`, which fails to validate the pointer location. This enables an attacker to write memory values from within the enclave.

An out of bounds read on the `enc untrusted inet ntop` function allows an attack to extend the result size that is used by `memcpy()` to read memory from within the enclave heap.

An arbitrary memory read issue allows an untrusted attacker to make a call to `enc untrusted recvmsg` using an attacker-controlled `result` parameter. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

An arbitrary memory read issue allows an untrusted attacker to make a call to `enc untrusted inet pton` using an attacker-controlled `klinux addr buffer` parameter. The parameter size is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

The issue allows an untrusted attacker to make a call to `enc untrusted read` whose return size was not validated against the requested size. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

The issue allows an untrusted attacker to make a call to `enc untrusted recvfrom` whose return size was not validated against the requested size. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

An arbitrary memory write issue allows an untrusted attacker to make a call to `ecall restore()` using the attribute `output` which fails to check the range of a `pointer`. An attacker can use this `pointer` to write to arbitrary memory addresses, including those within the secure enclave.

The issue allows an attacker to make an `Ecall restore` function call to reallocate untrusted code and overwrite sections of the Enclave memory address, due to an arbitrary memory overwrite.

An arbitrary memory overwrite issue allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within `sgx params` and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

An information disclosure issue exists when an enclave application using the syscalls provided by the `sockets.edl` is loaded by a malicious host application. This could allow an attacker to read privileged data from the enclave heap across trust boundaries. To exploit this, an attacker would have to log on to an affected system and run a specially crafted application. The issue does not allow an attacker to elevate user rights directly but could be used to obtain confidential information in an enclave, potentially used in further compromises.

A buffer length validation issue allows an attacker to read unauthorized data. The `enc untrusted recvfrom` function generates a return value deserialized by `MessageReader` and copied into three `extents`. The length of the third `extents` is controlled by external input and not verified on copy, enabling the attacker to force Asylo to copy trusted memory data into a small untrusted buffer.

The issue is related to an arbitrary memory overwrite in the trusted memory of Asylo. It occurs because the `ecall restore` function does not properly validate the range of the `output len` pointer, allowing an attacker to manipulate the `tmp output len` value and write to any location in the trusted memory.

The issue is related to the ignore section sym function in the elf.c file of the Binary File Descriptor (BFD) library, which is part of GNU Binutils. This function does not validate the output section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value. As a result, remote attackers can cause a denial of service, leading to a NULL pointer dereference and application crash, by providing a crafted file. For example, this can be demonstrated using objcopy.

The issue is related to the ` bfd XX bfd copy private bfd data common` function in the Binary File Descriptor (BFD) library, which processes a negative Data Directory size with an unbounded loop. This results in an out-of-bounds memory write. The vulnerability can be exploited by a remote attacker to cause a buffer overflow.

The issue arises from GNU Debugger's failure to detect a negative length field in a DWARF section. This can be exploited by a malformed section in an ELF binary or a core file, causing GDB to repeatedly allocate memory until a process limit is reached, potentially hindering analysis efforts, such as those involving malware.