CVE-2020-8944

Name of the Vulnerable Software and Affected Versions Asylo versions up to 0.6.0

Description An arbitrary memory write issue allows an untrusted attacker to make a call to ecall restore() using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses, including those within the secure enclave.

Recommendations For Asylo versions up to 0.6.0, upgrade past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a. As a temporary workaround, consider restricting the use of the ecall restore() function until a patch is available.