What’s Vulnerable › Vulnerabilities

CVE-2021-22549: Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-08 · updated 2026-06-17
• Weakness: CWE-823

Description

An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c

Affected products

• Google LLC Asylo: before 0.6.2 — fixed in 0.6.2

How to fix

Upgrade to a fixed version: Google LLC Asylo 0.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad
• https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad

Get alerted when CVE-2021-22549 or the next vulnerability affects your stack