CVE-2020-8904

MEDIUM

Asylo < 0.6.0 - Arbitrary Memory Overwrite via ecall_restore Output Length Validation

Title source: llm
STIX 2.1

Description

An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.

References (1)

Core 1

Scores

CVSS v3 6.4
EPSS 0.0023
EPSS Percentile 13.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H

Details

CWE
CWE-119 CWE-823
Status published
Products (1)
google/asylo < 0.6.0
Published Aug 12, 2020
Tracked Since Feb 18, 2026