CVE-2021-22548 Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall

Medium 6.5 Published 8 Jun 2021 Updated 17 Sep 2024

An attacker can read trusted memory regions by manipulating untrusted pointers in Asylo, leading to sensitive data disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22548?

CVE-2021-22548 is a medium-severity vulnerability in Google LLC Asylo, published on 8 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c

Weakness: CWE-788

Which versions are affected by CVE-2021-22548?

It affects 1 product.

Products include Google Asylo.

How do I fix CVE-2021-22548?

No fix has been published for CVE-2021-22548 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22548 being exploited?

There is no known exploitation of CVE-2021-22548 in the wild and no public exploit code.

Sources

Also known as GHSA-j42g-3m6p-674j.