Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall
Vulnerability Description
An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-22548
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Qinkun Bao (Baidu Security)
- Zhaofeng Chen (Baidu Security)
- Mingshen Sun (Baidu Security)
- Kang Li (Baidu Security)
More from Google LLC
View All →Affected Vendor
Google LLC
View all reports →