What’s Vulnerable › Vulnerabilities

CVE-2020-8905: Confidential Information Disclosure vulnerability in Asylo

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-12 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.

Affected products

• Google LLC Asylo: before 0.6.0 — fixed in 0.6.0

How to fix

Upgrade to a fixed version: Google LLC Asylo 0.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93
• https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93

Get alerted when CVE-2020-8905 or the next vulnerability affects your stack