Confidential Information Disclosure vulnerability in Asylo
CVE-2020-8905

2.8LOW

Key Information:

Vendor

Google
Status
Asylo
Vendor
CVE Published:
12 August 2020

What is CVE-2020-8905?

A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Asylo stable < 0.6.0

References

https://github.com/google/asylo/commit/299f804acbb95a612a...
x_refsource_CONFIRM

CVSS V3.1

Score:
2.8
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and Kang Li from Baidu Security
JSON
.