Critical
Security advisory
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-8904
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:41 UTC · Revision 1
Source evidence
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
osv:CVE-2020-8904
Complete source record
{
"id": "bfa16b4b4e63ca4cf7453e03939bc2fa3a5c1a732bfc9de4c6b7dcb216ea2a77",
"url": "https://osv.dev/vulnerability/CVE-2020-8904",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-8904",
"summary": "An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.",
"evidence": "osv:CVE-2020-8904",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-8904",
"aliases": [
"CVE-2020-8904"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/google/asylo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "299f804acbb95a612ab7c504d25ab908aa59ae93"
},
{
"fixed": "e582f36ac49ee11a21d23ad6a30c333092e0a94e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:google:asylo:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e582f36ac49ee11a21d23ad6a30c333092e0a94e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.5.3",
"buildenv-v0.5.3",
"v0.5.2",
"buildenv-v0.5.2",
"v0.5.1",
"buildenv-v0.5.1",
"v0.5.0",
"buildenv-v0.5.0",
"v0.4.1",
"buildenv-v0.4.1",
"v0.4.0",
"buildenv-v0.4.0",
"v0.3.4.1",
"v0.3.4",
"buildenv-v0.3.4",
"v0.3.3",
"buildenv-v0.3.3",
"v0.3.2",
"buildenv-v0.3.2",
"v0.3.1",
"buildenv-v0.3.1",
"v0.3.0",
"buildenv-v0.3.0",
"v0.2.2",
"buildenv-v0.2.2",
"v0.2.1",
"buildenv-v0.2.1",
"v0.2.0",
"buildenv-v0.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8904.json",
"vanir_signatures": [
{
"id": "CVE-2020-8904-231c0404",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232311576742852937528951488602353048356",
"239219903741322872622410301507378039653",
"98100078975615401589899147513071682994",
"264262808374229173759127247203979683848",
"168884572296058466466796399177656558076",
"194816803327240949914791498851530735736"
]
},
"source": "https://github.com/google/asylo/commit/e582f36ac49ee11a21d23ad6a30c333092e0a94e",
"target": {
"file": "asylo/platform/primitives/sgx/ecalls.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-8904-6c5c34f2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"206843566668820650509670967168184456061",
"80156147239961341313323500740088832576",
"199487815859305689901389025254287933562",
"164706716403506214144524274119973725632"
]
},
"source": "https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93",
"target": {
"file": "asylo/platform/host_call/trusted/host_calls.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-8904-ce65bfe1",
"digest": {
"length": 575,
"function_hash": "26899445440106890895090757480789185378"
},
"source": "https://github.com/google/asylo/commit/e582f36ac49ee11a21d23ad6a30c333092e0a94e",
"target": {
"file": "asylo/platform/primitives/sgx/ecalls.cc",
"function": "ecall_restore"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-8904-da74cbf8",
"digest": {
"length": 1020,
"function_hash": "14747568182961413266336135363801043561"
},
"source": "https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93",
"target": {
"file": "asylo/platform/host_call/trusted/host_calls.cc",
"function": "enc_untrusted_recvfrom"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:14:06Z"
}
}
],
"modified": "2026-10-20T14:14:06.181373212Z",
"provider": "osv",
"references": [
"https://github.com/google/asylo/commit/e582f36ac49ee11a21d23ad6a30c333092e0a94e"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-8904",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388738,
"published_at": "2020-08-12T19:15:14.593+00:00"
}