CVE-2019-1370

Опубликовано: 12 нояб. 2019

Источник: msrc

CVSS3: 7

EPSS Низкий

Описание

Open Enclave SDK Information Disclosure Vulnerability

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information stored in the Enclave.

To exploit this vulnerability, an attacker would have to successfully compromise the host application running the enclave. The attacker can then pivot to the enclave and exploit this vulnerability without user interaction.

The security update addresses the vulnerability by modifying how Open Enclave SDK handle objects in memory.

FAQ

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Enclave memory read - unprivileged write to enclave memory from a host application, which can leak memory contents of the enclave.

Обновления

Продукт	Статья	Обновление
Open Enclave SDK	Release Notes	Security Update

Показывать по

Возможность эксплуатации

Publicly Disclosed

Exploited

Latest Software Release

Exploitation Less Likely

Older Software Release

Exploitation Less Likely

EPSS

Процентиль: 70%

0.00639

Низкий

7 High

CVSS3

Связанные уязвимости

CVE-2019-1370

CVSS3: 5.5

nvd

почти 6 лет назад

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.

GHSA-c8r4-mr69-33v6

github

больше 3 лет назад