CVE-2021-22552CWE-126

Memory overread secure enclave in Asylo 0.6.2

Medium · published August 2, 2021

CVSS v3.1
5.3
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00151 · 3.9th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2021-08-02T15:40Z
EPSS history
Timeline
  • 02 AUG 15:40Z
    Memory overread secure enclave in Asylo 0.6.2
    cvelistv5