Description (CNA)
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Google LLC / Asylo | affected stable before 0.6.0 |
CWE
CWE-823
References
ADP enrichment
No English description supplied.