CVE-2020-8936

MEDIUM

Google Asylo < 0.6.0 - Out-of-Bounds Read

Title source: rule
STIX 2.1

Description

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0002
EPSS Percentile 5.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Details

CWE
CWE-125
Status published
Products (1)
google/asylo < 0.6.0
Published Dec 15, 2020
Tracked Since Feb 18, 2026