CVE-2020-8905
Last modified
CVE-2020-8905 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Asylo | < 0.6.0 |
References
- https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93Patch, Third Party Advisory
- https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8905?
How severe is CVE-2020-8905?
How do I fix CVE-2020-8905?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-8896A Buffer Overflow vulnerability in the khcrypt implementatio…5.9
- CVE-2020-8897A weak robustness vulnerability exists in the AWS Encryption…8.1
- CVE-2020-8899There is a buffer overwrite vulnerability in the Quram qmg l…9.8
- CVE-2020-8902Rendertron versions prior to 3.0.0 are are susceptible to a …4.3
- CVE-2020-8903A vulnerability in Google Cloud Platform's guest-oslogin ver…7.8
- CVE-2020-8904An arbitrary memory overwrite vulnerability in the trusted m…9.6
- CVE-2020-8907A vulnerability in Google Cloud Platform's guest-oslogin ver…7.8
- CVE-2020-8908A temp directory creation vulnerability exists in all versio…3.3
- CVE-2020-8910A URL parsing issue in goog.uri of the Google Closure Librar…6.5
- CVE-2020-8911A padding oracle vulnerability exists in the AWS S3 Crypto S…5.6
- CVE-2020-8912A vulnerability in the in-band key negotiation exists in the…2.5
- CVE-2020-8913A local, arbitrary code execution vulnerability exists in th…8.8
Are you affected by CVE-2020-8905?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST