PT-2020-20376
CVE-2020-8938
·
Published
2020-12-15
·
Updated
2020-12-17
Description by
CVSS 3.1
5.3
MediumMetricsAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Asylo versions up to 0.6.0
Description
An arbitrary memory overwrite issue allows an attacker to make a host call to
FromkLinuxSockAddr with attacker-controlled content and size of klinux addr, enabling the attacker to write memory values from within the enclave.Recommendations
For Asylo versions up to 0.6.0, upgrade past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾