Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer

published 2021-06-08 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9691

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits: 0; none known

An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c

Patch / fix

fixed in 1 links 1

google asylo 0.6.3

github.com/google/asylo@a47ef55 commit

Exploit prediction

0.10% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

Google LLC Asylo

Classification

Weakness

CWE-823 Use of Out-of-range Pointer Offset
CWE-668 Exposure of Resource to Wrong Sphere

References

github.com /google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
patch, third-party-advisory

Sources

CVE List CVE-2021-22550
NVD CVE-2021-22550

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary