Mingshen Sun

The issue allows an untrusted attacker to bypass validation by passing a syscall number in `MessageReader` that is then used by `sysno()`, potentially enabling the attacker to read memory from within the secure enclave.

An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory.

An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave.

An attacker can change the pointer to untrusted memory to point to a trusted memory region, causing copying of trusted memory to trusted memory. If the latter is later copied out, it allows for reading of memory regions from the trusted region.

An arbitrary memory overwrite issue allows an attacker to make a host call to `FromkLinuxSockAddr` with attacker-controlled content and size of `klinux addr`, enabling the attacker to write memory values from within the enclave.

An out of bounds read on the `enc untrusted inet ntop` function allows an attack to extend the result size that is used by `memcpy()` to read memory from within the enclave heap.

An arbitrary memory read issue allows an untrusted attacker to make a call to `enc untrusted inet pton` using an attacker-controlled `klinux addr buffer` parameter. The parameter size is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

The issue allows an untrusted attacker to make a call to `enc untrusted read` whose return size was not validated against the requested size. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

The issue allows an untrusted attacker to make a call to `enc untrusted recvfrom` whose return size was not validated against the requested size. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

An arbitrary memory write issue allows an untrusted attacker to make a call to `ecall restore()` using the attribute `output` which fails to check the range of a `pointer`. An attacker can use this `pointer` to write to arbitrary memory addresses, including those within the secure enclave.

An arbitrary memory read issue allows an untrusted attacker to make a call to `enc untrusted recvmsg` using an attacker-controlled `result` parameter. The `size` parameter is unchecked, allowing the attacker to read memory locations outside of the intended buffer size, including memory addresses within the secure enclave.

The issue allows an attacker to make an `Ecall restore` function call to reallocate untrusted code and overwrite sections of the Enclave memory address, due to an arbitrary memory overwrite.

An arbitrary memory overwrite issue allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within `sgx params` and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

An arbitrary memory overwrite issue allows an attacker to make a host call to `enc untrusted create wait queue` that uses a pointer queue relying on `UntrustedLocalMemcpy`, which fails to validate the pointer location. This enables an attacker to write memory values from within the enclave.

An information disclosure issue exists when an enclave application using the syscalls provided by the `sockets.edl` is loaded by a malicious host application. This could allow an attacker to read privileged data from the enclave heap across trust boundaries. To exploit this, an attacker would have to log on to an affected system and run a specially crafted application. The issue does not allow an attacker to elevate user rights directly but could be used to obtain confidential information in an enclave, potentially used in further compromises.

A buffer length validation issue allows an attacker to read unauthorized data. The `enc untrusted recvfrom` function generates a return value deserialized by `MessageReader` and copied into three `extents`. The length of the third `extents` is controlled by external input and not verified on copy, enabling the attacker to force Asylo to copy trusted memory data into a small untrusted buffer.

The issue is related to an arbitrary memory overwrite in the trusted memory of Asylo. It occurs because the `ecall restore` function does not properly validate the range of the `output len` pointer, allowing an attacker to manipulate the `tmp output len` value and write to any location in the trusted memory.