Asylo vulnerabilitiesRanked by how likely they are to be used.
Asylo is made by Google. We track 16 published vulnerabilities in it, across 17 versions. None of them is on the list of flaws known to be exploited today. If you run Asylo, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Asylo vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Asylo's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Asylo flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 0.2%CVE-2020-8905Medium
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to.
- 0.2%CVE-2020-8904Critical
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0.
- 0.2%CVE-2020-8944Medium
An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer.
- 0.2%CVE-2021-22552Medium
An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation.
- 0.1%CVE-2020-8935High
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address.
- 0.1%CVE-2020-8941Medium
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter.
- 0.1%CVE-2020-8936Medium
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall.
- 0.1%CVE-2020-8939Medium
An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within the enclave heap.
- 0.1%CVE-2020-8940Medium
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker controlled result parameter.
- 0.1%CVE-2020-8942Medium
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size.
Running Asylo? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.
- Matched to
- Asylo on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 16 published vulnerabilities listed under the name Asylo, across 17 versions.
None of Asylo's vulnerabilities is on the list of flaws known to be exploited today.
Create a EdgeProtect account and track Asylo. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.