Vulnerability-Lookup

GHSA-WV62-PFMM-X787

Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36

Details

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-8937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-15T15:15:00Z",
    "severity": "LOW"
  },
  "details": "An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02",
  "id": "GHSA-wv62-pfmm-x787",
  "modified": "2022-05-24T17:36:36Z",
  "published": "2022-05-24T17:36:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8937"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2020-8937 (GCVE-0-2020-8937)

Vulnerability from cvelistv5 – Published: 2020-12-15 14:55 – Updated: 2024-08-04 10:12

Title

Arbitrary enclave memory location write from untrusted environment

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-120 - Buffer Overflow

Assigner

Google

References

1 reference

URL	Tags
https://github.com/google/asylo/commit/a37fb6a0e7…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Google LLC	Asylo	Affected: 0.6.0 , ≤ 0.6.0 (custom)

Credits

Qinkun Bao (Baidu Security) Zhaofeng Chen (Baidu Security) Mingshen Sun (Baidu Security) Kang Li (Baidu Security)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:11.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Asylo",
          "vendor": "Google LLC",
          "versions": [
            {
              "lessThanOrEqual": "0.6.0",
              "status": "affected",
              "version": "0.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qinkun Bao (Baidu Security)"
        },
        {
          "lang": "en",
          "value": "Zhaofeng Chen (Baidu Security)"
        },
        {
          "lang": "en",
          "value": "Mingshen Sun (Baidu Security)"
        },
        {
          "lang": "en",
          "value": "Kang Li (Baidu Security)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-15T14:55:33.000Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary enclave memory location write from untrusted environment",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@google.com",
          "ID": "CVE-2020-8937",
          "STATE": "PUBLIC",
          "TITLE": "Arbitrary enclave memory location write from untrusted environment"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Asylo",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "0.6.0",
                            "version_value": "0.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Google LLC"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Qinkun Bao (Baidu Security)"
          },
          {
            "lang": "eng",
            "value": "Zhaofeng Chen (Baidu Security)"
          },
          {
            "lang": "eng",
            "value": "Mingshen Sun (Baidu Security)"
          },
          {
            "lang": "eng",
            "value": "Kang Li (Baidu Security)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-120 Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02",
              "refsource": "CONFIRM",
              "url": "https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2020-8937",
    "datePublished": "2020-12-15T14:55:34.000Z",
    "dateReserved": "2020-02-12T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:11.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WV62-PFMM-X787

CVE-2020-8937 (GCVE-0-2020-8937)

Tags

Sightings

Nomenclature