Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-8935: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-25 11:11:32 -0700
Commit message: Check return pointer is outside enclave in realloc

PiperOrigin-RevId: 333769459
Change-Id: If53b5f4317080b8abaf5c4f80ce751f150630bcb

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index 3e6bf1034..0532b334f 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -642,10 +642,16 @@ void *enc_untrusted_realloc(void *ptr, size_t size) {
   // realloc only sets the errno (ENOMEM) when output pointer is null and a
   // non-zero |size| is provided.
   if (!result && size != 0) {
     errno = FromkLinuxErrorNumber(klinux_errno);
   }
+
+  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_realloc: realloc result should be in untrusted "
+        "memory");
+  }
   return result;
 }
 
 uint32_t enc_untrusted_sleep(uint32_t seconds) {
   MessageWriter input;

Fixed code: 
  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_realloc: realloc result should be in untrusted "
        "memory");
  }
CVE-2020-8935: Out-of-bounds Write (CWE-787)
value: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-25 11:11:32 -0700
Commit message: Check return pointer is outside enclave in realloc

PiperOrigin-RevId: 333769459
Change-Id: If53b5f4317080b8abaf5c4f80ce751f150630bcb

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index 3e6bf1034..0532b334f 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -642,10 +642,16 @@ void *enc_untrusted_realloc(void *ptr, size_t size) {
   // realloc only sets the errno (ENOMEM) when output pointer is null and a
   // non-zero |size| is provided.
   if (!result && size != 0) {
     errno = FromkLinuxErrorNumber(klinux_errno);
   }
+
+  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_realloc: realloc result should be in untrusted "
+        "memory");
+  }
   return result;
 }
 
 uint32_t enc_untrusted_sleep(uint32_t seconds) {
   MessageWriter input;

Fixed code: 
  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_realloc: realloc result should be in untrusted "
        "memory");
  }
CVE-2020-8936: Out-of-bounds Read (CWE-125)
value: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/trusted_sgx.cc
Commit date: 2020-09-25 12:10:12 -0700
Commit message: Verify UntrustedCall output is outside enclave

PiperOrigin-RevId: 333781703
Change-Id: I9df55c04dc8b04f4bf0bda8e68cc32bca81b933a

Diff: diff --git a/asylo/platform/primitives/sgx/trusted_sgx.cc b/asylo/platform/primitives/sgx/trusted_sgx.cc
index 173d1a933..092a2040f 100644
--- a/asylo/platform/primitives/sgx/trusted_sgx.cc
+++ b/asylo/platform/primitives/sgx/trusted_sgx.cc
@@ -286,10 +286,15 @@ PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,
   CHECK_OCALL(
       ocall_dispatch_untrusted_call(&ret, untrusted_selector, sgx_params));
   if (sgx_params->input) {
     untrusted_cache->Free(const_cast<void *>(sgx_params->input));
   }
+  if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
+                                           sgx_params->output_size)) {
+    TrustedPrimitives::BestEffortAbort(
+        "UntrustedCall: sgx_param output should be in untrusted memory");
+  }
   if (sgx_params->output) {
     // For the results obtained in |output_buffer|, copy them to |output|
     // before freeing the buffer.
     output->Deserialize(sgx_params->output, sgx_params->output_size);
     TrustedPrimitives::UntrustedLocalFree(sgx_params->output);

Fixed code:   if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
                                           sgx_params->output_size)) {
    TrustedPrimitives::BestEffortAbort(
        "UntrustedCall: sgx_param output should be in untrusted memory");
  }
CVE-2020-8937: Out-of-bounds Write (CWE-787)
value: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 3.3
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/concurrency.cc
Commit date: 2020-09-23 14:16:30 -0700
Commit message: Check untrusted queue is in outside enclave

PiperOrigin-RevId: 333370935
Change-Id: Ic3f15d5db1302d95c7cb199b44172474fecb81ca

Diff: diff --git a/asylo/platform/host_call/trusted/concurrency.cc b/asylo/platform/host_call/trusted/concurrency.cc
index e1bd796cb..ede6bddb0 100644
--- a/asylo/platform/host_call/trusted/concurrency.cc
+++ b/asylo/platform/host_call/trusted/concurrency.cc
@@ -91,10 +91,14 @@ int32_t *enc_untrusted_create_wait_queue() {
   const auto status = NonSystemCallDispatcher(
       ::asylo::host_call::kLocalLifetimeAllocHandler, &input, &output);
   CheckStatusAndParamCount(status, output, "enc_untrusted_create_wait_queue",
                            2);
   int32_t *queue = reinterpret_cast<int32_t *>(output.next<uintptr_t>());
+  if (!TrustedPrimitives::IsOutsideEnclave(queue, sizeof(int32_t))) {
+    TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_create_wait_queue: queue should be in untrusted memory");
+  }
   int klinux_errno = output.next<int>();
   if (queue == nullptr) {
     errno = FromkLinuxErrorNumber(klinux_errno);
   }
   enc_untrusted_disable_waiting(queue);

Fixed code:   if (!TrustedPrimitives::IsOutsideEnclave(queue, sizeof(int32_t))) {
    TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_create_wait_queue: queue should be in untrusted memory");
  }
CVE-2020-8939: Out-of-bounds Read (CWE-125)
value: An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within the enclave heap. We recommend upgrading past commit 6ff3b77ffe110a33a2f93848a6333f33616f02c4
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-25 14:53:05 -0700
Commit message: Check for result size in dst in inet_ntop

PiperOrigin-RevId: 333814318
Change-Id: Id7766ed598809f5df42d457f224d6f3dea06c224

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index 0532b334f..a2e2b0df1 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -1323,13 +1323,14 @@ const char *enc_untrusted_inet_ntop(int af, const void *src, char *dst,
   if (result.empty()) {
     errno = FromkLinuxErrorNumber(klinux_errno);
     return nullptr;
   }
 
-  memcpy(dst, result.data(),
-         std::min(static_cast<size_t>(size),
-                  static_cast<size_t>(INET6_ADDRSTRLEN)));
+  memcpy(
+      dst, result.data(),
+      std::min({static_cast<size_t>(size), static_cast<size_t>(result.size()),
+                static_cast<size_t>(INET6_ADDRSTRLEN)}));
   return dst;
 }
 
 int enc_untrusted_sigprocmask(int how, const sigset_t *set, sigset_t *oldset) {
   klinux_sigset_t klinux_set;

Vulnerable code:   memcpy(dst, result.data(),
         std::min(static_cast<size_t>(size),
                  static_cast<size_t>(INET6_ADDRSTRLEN)));
Fixed code:   memcpy(
      dst, result.data(),
      std::min({static_cast<size_t>(size), static_cast<size_t>(result.size()),
                static_cast<size_t>(INET6_ADDRSTRLEN)}));
CVE-2020-8940: Out-of-bounds Read (CWE-125)
value: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker controlled result parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading or past commit fa6485c5d16a7355eab047d4a44345a73bc9131e
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-23 17:57:04 -0700
Commit message: Check return result in recvmsg

PiperOrigin-RevId: 333411798
Change-Id: I61986b5a1bffd79c0e1950013aa9de09cf4a5d61

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index adf4c48a6..3e6bf1034 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -820,10 +820,15 @@ ssize_t enc_untrusted_recvmsg(int sockfd, struct msghdr *msg, int flags) {
   if (result == -1) {
     errno = FromkLinuxErrorNumber(klinux_errno);
     return result;
   }
 
+  if (result > total_buffer_size) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_recvmsg: result exceeds requested");
+  }
+
   auto msg_name_extent = output.next();
   // The returned |msg_namelen| should not exceed the buffer size.
   if (msg_name_extent.size() <= msg->msg_namelen) {
     msg->msg_namelen = msg_name_extent.size();
   }

Fixed code:   if (result > total_buffer_size) {
    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_recvmsg: result exceeds requested");
  }
CVE-2020-8941: Out-of-bounds Read (CWE-125)
value: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 8fed5e334131abaf9c5e17307642fbf6ce4a57ec
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-25 15:34:34 -0700
Commit message: Check sockaddr size in inet_pton

PiperOrigin-RevId: 333821843
Change-Id: Ie0b694f1edd3f7a4a3de6df964d68566961accf6

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index a2e2b0df1..e1b575cda 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -1281,12 +1281,20 @@ int enc_untrusted_inet_pton(int af, const char *src, void *dst) {
   }
 
   auto klinux_addr_buffer = output.next();
   size_t max_size = 0;
   if (af == AF_INET) {
+    if (klinux_addr_buffer.size() != sizeof(klinux_in_addr)) {
+      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+          "enc_untrusted_inet_pton: unexpected output size");
+    }
     max_size = sizeof(struct in_addr);
   } else if (af == AF_INET6) {
+    if (klinux_addr_buffer.size() != sizeof(klinux_in6_addr)) {
+      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+          "enc_untrusted_inet_pton: unexpected output size");
+    }
     max_size = sizeof(struct in6_addr);
   }
   memcpy(dst, klinux_addr_buffer.data(),
          std::min(klinux_addr_buffer.size(), max_size));
   return result;

Fixed code:     if (klinux_addr_buffer.size() != sizeof(klinux_in_addr)) {
      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
          "enc_untrusted_inet_pton: unexpected output size");
    }
    if (klinux_addr_buffer.size() != sizeof(klinux_in6_addr)) {
      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
          "enc_untrusted_inet_pton: unexpected output size");
    }
CVE-2020-8942: Out-of-bounds Read (CWE-125)
value: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit b1d120a2c7d7446d2cc58d517e20a1b184b82200
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-25 16:09:54 -0700
Commit message: Check for return size in enc_untrusted_read

Check return size does not exceed requested. The returned result and
content still cannot be trusted, but it's expected behavior when not
using a secure file system.

PiperOrigin-RevId: 333827386
Change-Id: I0bdec0aec9356ea333dc8c647eba5d2772875f29

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index e1b575cda..6d7525af1 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -224,12 +224,17 @@ int enc_untrusted_rename(const char *oldpath, const char *newpath) {
   return EnsureInitializedAndDispatchSyscall(asylo::system_call::kSYS_rename,
                                              oldpath, newpath);
 }
 
 ssize_t enc_untrusted_read(int fd, void *buf, size_t count) {
-  return static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
+  ssize_t ret = static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
       asylo::system_call::kSYS_read, fd, buf, count));
+  if (ret != -1 && ret > count) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_read: read result exceeds requested");
+  }
+  return ret;
 }
 
 ssize_t enc_untrusted_write(int fd, const void *buf, size_t count) {
   return static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
       asylo::system_call::kSYS_write, fd, buf, count));

Vulnerable code:   return static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
Fixed code:   ssize_t ret = static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
  if (ret != -1 && ret > count) {
    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_read: read result exceeds requested");
  }
  return ret;
CVE-2020-8943: Out-of-bounds Read (CWE-125)
value: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvfrom whose return size was not validated against the requested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 6e158d558abd3c29a0208e30c97c9a8c5bd4230f
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-09-23 16:39:58 -0700
Commit message: Check for result of recvfrom

PiperOrigin-RevId: 333399155
Change-Id: I3d79e1e3f45f75d4c4360d42499e511d84b9aff7

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index 6e37ebf00..adf4c48a6 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -979,10 +979,15 @@ ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,
   if (result == -1) {
     errno = FromkLinuxErrorNumber(klinux_errno);
     return result;
   }
 
+  if (result > len) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_recvfrom: result exceeds requested");
+  }
+
   auto buffer_received = output.next();
   memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));
 
   // If |src_addr| is not NULL, and the underlying protocol provides the source
   // address, this source address is filled in. When |src_addr| is NULL, nothing

Fixed code:   if (result > len) {
    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
        "enc_untrusted_recvfrom: result exceeds requested");
  }
CVE-2020-8944: Out-of-bounds Write (CWE-787)
value: An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses including those within the secure enclave We recommend upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-15T15:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/ecalls.cc
Commit date: 2020-09-28 16:49:54 -0700
Commit message: Check output of ecall_restore is outside enclave

PiperOrigin-RevId: 334265380
Change-Id: Ifbaead6bce56f01b2a4d69f53ca508d0138f6f61

Diff: diff --git a/asylo/platform/primitives/sgx/ecalls.cc b/asylo/platform/primitives/sgx/ecalls.cc
index a15ff7bc4..f253fd414 100644
--- a/asylo/platform/primitives/sgx/ecalls.cc
+++ b/asylo/platform/primitives/sgx/ecalls.cc
@@ -62,11 +62,13 @@ int ecall_take_snapshot(char **output, uint64_t *output_len) {
 int ecall_restore(const char *input, uint64_t input_len, char **output,
                   uint64_t *output_len) {
   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,
                                                               input_len) ||
       !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(
-          output_len, sizeof(uint64_t))) {
+          output_len, sizeof(uint64_t)) ||
+      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(output,
+                                                              *output_len)) {
     asylo::primitives::TrustedPrimitives::BestEffortAbort(
         "ecall_restore: input/output found to not be in untrusted memory.");
   }
   int result = 0;
   size_t tmp_output_len;

Vulnerable code:           output_len, sizeof(uint64_t))) {
Fixed code:           output_len, sizeof(uint64_t)) ||
      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(output,
                                                              *output_len)) {
CVE-2021-22548: Other (NVD-CWE-Other)
value: An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-06-08T14:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/trusted_sgx.cc
Commit date: 2021-03-29 13:17:26 -0700
Commit message: Store untrusted output pointer in enclave

Validate the pointer after it's stored in enclave to avoid unexpected
modifications after it's validated.

PiperOrigin-RevId: 365648810
Change-Id: I3079128040c142e86bab8255b07d03562a6fcb61

Diff: diff --git a/asylo/platform/primitives/sgx/trusted_sgx.cc b/asylo/platform/primitives/sgx/trusted_sgx.cc
index 1fcbcb8fc..a39a954a8 100644
--- a/asylo/platform/primitives/sgx/trusted_sgx.cc
+++ b/asylo/platform/primitives/sgx/trusted_sgx.cc
@@ -304,19 +304,20 @@ PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,
   CHECK_OCALL(
       ocall_dispatch_untrusted_call(&ret, untrusted_selector, sgx_params));
   if (sgx_params->input) {
     untrusted_cache->Free(const_cast<void *>(sgx_params->input));
   }
-  if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
-                                           sgx_params->output_size)) {
+  const void *output_pointer = sgx_params->output;
+  uint64_t output_size = sgx_params->output_size;
+  if (!TrustedPrimitives::IsOutsideEnclave(output_pointer, output_size)) {
     TrustedPrimitives::BestEffortAbort(
         "UntrustedCall: sgx_param output should be in untrusted memory");
   }
   if (sgx_params->output) {
     // For the results obtained in |output_buffer|, copy them to |output|
     // before freeing the buffer.
-    output->Deserialize(sgx_params->output, sgx_params->output_size);
+    output->Deserialize(output_pointer, output_size);
     TrustedPrimitives::UntrustedLocalFree(sgx_params->output);
   }
   return PrimitiveStatus::OkStatus();
 }
 

Vulnerable code:   if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
                                           sgx_params->output_size)) {
    output->Deserialize(sgx_params->output, sgx_params->output_size);
Fixed code:   const void *output_pointer = sgx_params->output;
  uint64_t output_size = sgx_params->output_size;
  if (!TrustedPrimitives::IsOutsideEnclave(output_pointer, output_size)) {
    output->Deserialize(output_pointer, output_size);
CVE-2021-22549: Exposure of Resource to Wrong Sphere (CWE-668)
value: An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.8
Published: 2021-06-08T14:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/trusted_sgx.cc
Commit date: 2021-03-12 10:43:12 -0800
Commit message: Store untrusted input to enclave variable

The untrusted input pointer should be stored to trusted variable before
checking to avoid unexpected modifications after checking.

PiperOrigin-RevId: 362553830
Change-Id: I743f9bd3487de60269e247d74f2188f2ffc06d01

Diff: diff --git a/asylo/platform/primitives/sgx/trusted_sgx.cc b/asylo/platform/primitives/sgx/trusted_sgx.cc
index 34bea2625..3b16e39fb 100644
--- a/asylo/platform/primitives/sgx/trusted_sgx.cc
+++ b/asylo/platform/primitives/sgx/trusted_sgx.cc
@@ -279,16 +279,17 @@ PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,
   if (input) {
     sgx_params->input_size = input->MessageSize();
     if (sgx_params->input_size > 0) {
       // Allocate and copy data to |input_buffer|.
       sgx_params->input = untrusted_cache->Malloc(sgx_params->input_size);
-      if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->input,
-                                               sgx_params->input_size)) {
+      const void *input_pointer = sgx_params->input;
+      uint64_t input_size = sgx_params->input_size;
+      if (!TrustedPrimitives::IsOutsideEnclave(input_pointer, input_size)) {
         TrustedPrimitives::BestEffortAbort(
             "UntrustedCall: sgx_param input should be in untrusted memory");
       }
-      input->Serialize(const_cast<void *>(sgx_params->input));
+      input->Serialize(const_cast<void *>(input_pointer));
     }
   }
   sgx_params->output_size = 0;
   sgx_params->output = nullptr;
   CHECK_OCALL(

Vulnerable code:       if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->input,
                                               sgx_params->input_size)) {
      input->Serialize(const_cast<void *>(sgx_params->input));
Fixed code:       const void *input_pointer = sgx_params->input;
      uint64_t input_size = sgx_params->input_size;
      if (!TrustedPrimitives::IsOutsideEnclave(input_pointer, input_size)) {
      input->Serialize(const_cast<void *>(input_pointer));
CVE-2021-22550: Exposure of Resource to Wrong Sphere (CWE-668)
value: An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.8
Published: 2021-06-08T14:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/untrusted_cache_malloc.cc
Commit date: 2021-02-19 13:42:29 -0800
Commit message: Fix vulnerability in UntrustedCacheMalloc

The pointer array is stored in untrusted memory, so we cannot trust the
value even after validation. We should validate the pointer is pointing
to untrusted memory after it's stored inside the enclave.

PiperOrigin-RevId: 358474391
Change-Id: I63cf6c251bdaf1b491dbf06cc0dcf77f7b141756

Diff: diff --git a/asylo/platform/primitives/sgx/untrusted_cache_malloc.cc b/asylo/platform/primitives/sgx/untrusted_cache_malloc.cc
index 7412ae01d..9517763b3 100644
--- a/asylo/platform/primitives/sgx/untrusted_cache_malloc.cc
+++ b/asylo/platform/primitives/sgx/untrusted_cache_malloc.cc
@@ -102,15 +102,16 @@ void *UntrustedCacheMalloc::GetBuffer() {
     is_pool_empty = buffer_pool_.empty();
     if (is_pool_empty) {
       buffers =
           primitives::AllocateUntrustedBuffers(kPoolIncrement, kPoolEntrySize);
       for (int i = 0; i < kPoolIncrement; i++) {
-        if (!buffers[i] ||
-            !TrustedPrimitives::IsOutsideEnclave(buffers[i], kPoolEntrySize)) {
-          abort();
+        void *buf = buffers[i];
+        if (!buf || !TrustedPrimitives::IsOutsideEnclave(buf, kPoolEntrySize)) {
+          TrustedPrimitives::BestEffortAbort(
+              "Cached buffer is not outside the enclave");
         }
-        buffer_pool_.push(buffers[i]);
+        buffer_pool_.push(buf);
       }
     }
     buffer = buffer_pool_.top();
     buffer_pool_.pop();
     busy_buffers_.insert(buffer);

Vulnerable code:         if (!buffers[i] ||
            !TrustedPrimitives::IsOutsideEnclave(buffers[i], kPoolEntrySize)) {
          abort();
        buffer_pool_.push(buffers[i]);
Fixed code:         void *buf = buffers[i];
        if (!buf || !TrustedPrimitives::IsOutsideEnclave(buf, kPoolEntrySize)) {
          TrustedPrimitives::BestEffortAbort(
              "Cached buffer is not outside the enclave");
        buffer_pool_.push(buf);
CVE-2021-22552: Out-of-bounds Read (CWE-125)
value: An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-08-02T16:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/system_call/system_call.cc
Commit date: 2021-06-03 11:02:29 -0700
Commit message: Add sysno check in MessageReader

The sysno in MessageReader is interpreted from the Message header passed
from the host. A malicious Message header may provide a modified sysno
to bypass the validation, and overwrites enclave memory. This change
adds a check for sysno to make sure it matches the expected value.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 377328054
Change-Id: I3ff6f60694d3390f66da89d139cf7cc7b49abaea

Diff: diff --git a/asylo/platform/system_call/system_call.cc b/asylo/platform/system_call/system_call.cc
index 5862632994..2b6ab69ed6 100644
--- a/asylo/platform/system_call/system_call.cc
+++ b/asylo/platform/system_call/system_call.cc
@@ -113,10 +113,13 @@ extern "C" int64_t enc_untrusted_syscall(int sysno, ...) {
   }
 
   // Copy outputs back into pointer parameters.
   auto response_reader =
       asylo::system_call::MessageReader({response_buffer, response_size});
+  if (response_reader.sysno() != sysno) {
+    error_handler("system_call.cc: Unexpected sysno in response");
+  }
   const asylo::primitives::PrimitiveStatus response_status =
       response_reader.Validate();
   if (!response_status.ok()) {
     error_handler(
         "system_call.cc: Error deserializing response buffer into response "

Fixed code:   if (response_reader.sysno() != sysno) {
    error_handler("system_call.cc: Unexpected sysno in response");
  }
CVE-2024-25714: Insufficient Information (NVD-CWE-noinfo)
value: In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-11T03:15Z
Repository: https://github.com/babelouest/rhonabwy
Language: C
Files changed: src/jws.c
Commit date: 2024-02-05 17:26:23 -0500
Commit message: Mitigate HMAC signature side-channel attack

Thanks to Erwan Legrand

Diff: diff --git a/src/jws.c b/src/jws.c
index 863a3e7..14f0261 100644
--- a/src/jws.c
+++ b/src/jws.c
@@ -477,11 +477,14 @@ static unsigned char * r_jws_sign_es256k(jws_t * jws, jwk_t * jwk) {
 
 static int r_jws_verify_sig_hmac(jws_t * jws, jwk_t * jwk) {
   unsigned char * sig = r_jws_sign_hmac(jws, jwk);
   int ret;
 
-  if (sig != NULL && 0 == o_strcmp((const char *)jws->signature_b64url, (const char *)sig)) {
+  if (!o_strnullempty((const char *)jws->signature_b64url) &&
+      !o_strnullempty((const char *)sig) &&
+      o_strlen((const char *)sig) == o_strlen((const char *)jws->signature_b64url) &&
+      0 == gnutls_memcmp(jws->signature_b64url, sig, o_strlen((const char *)sig))) {
     ret = RHN_OK;
   } else {
     ret = RHN_ERROR_INVALID;
   }
   o_free(sig);

Vulnerable code:   if (sig != NULL && 0 == o_strcmp((const char *)jws->signature_b64url, (const char *)sig)) {
Fixed code:   if (!o_strnullempty((const char *)jws->signature_b64url) &&
      !o_strnullempty((const char *)sig) &&
      o_strlen((const char *)sig) == o_strlen((const char *)jws->signature_b64url) &&
      0 == gnutls_memcmp(jws->signature_b64url, sig, o_strlen((const char *)sig))) {
CVE-2021-25941: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-05-14T14:15Z
Repository: https://github.com/ASaiAnudeep/deep-override
Language: JavaScript
Files changed: src/index.js
Commit date: 2020-12-17 22:31:18 +0530
Commit message: Security fix for Prototype Pollution
Diff: diff --git a/src/index.js b/src/index.js
index c2f04ed..b92a850 100644
--- a/src/index.js
+++ b/src/index.js
@@ -44,10 +44,12 @@ function override(...rawArgs) {
         }
         return;
       });
     } else {
       Object.keys(obj).forEach(key => {
+        if (key == '__proto__' || key == 'constructor' || key == 'prototype')
+          return
         src = target[key];
         val = obj[key];
         if (val === target) {
         } else if (typeof val !== 'object' || val === null) {
           target[key] = val;
@@ -67,6 +69,6 @@ function override(...rawArgs) {
     }
   });
   return target;
 }
 
-module.exports = override;
\ No newline at end of file
+module.exports = override;

Vulnerable code: module.exports = override;
Fixed code:         if (key == '__proto__' || key == 'constructor' || key == 'prototype')
          return
module.exports = override;
CVE-2018-25059: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 is able to address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2022-12-30T11:15Z
Repository: https://github.com/jessfraz/pastebinit
Language: Unknown
Commit date: 2018-07-18 19:44:17 -0400
Commit message: Merge pull request #3 from ilyaglow/security-fix

Fix path traversal and storage path leak
CVE-2023-32684: Files or Directories Accessible to External Parties (CWE-552)
value: Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 2.5
Published: 2023-05-30T18:15Z
Repository: https://github.com/lima-vm/lima
Language: Unknown
Commit date: 2023-05-30 13:23:52 +0900
Commit message: Merge pull request from GHSA-f7qw-jj9c-rpq9

Prohibit using a differential disk as a base disk
CVE-2022-1291: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-10T20:15Z
Repository: https://github.com/hhurz/tableexport.jquery.plugin
Language: JSON
Files changed: bower.json, package.json, tableExport.js, tableExport.min.js
Commit date: 2022-04-10 21:02:54 +0200
Commit message: Release 1.25

Diff: diff --git a/bower.json b/bower.json
index 76608e4..f10904a 100644
--- a/bower.json
+++ b/bower.json
@@ -1,8 +1,8 @@
 {
   "name": "tableexport.jquery.plugin",
-  "version": "1.22.0",
+  "version": "1.25.0",
   "description": "html table export",
   "main": "tableExport.js",
   "authors": [
     "hhurz"
   ],
diff --git a/package.json b/package.json
index 50ffe52..a7b063a 100644
--- a/package.json
+++ b/package.json
@@ -1,12 +1,12 @@
 {
   "name": "tableexport.jquery.plugin",
-  "version": "1.22.0",
+  "version": "1.25.0",
   "description": "html table export",
   "main": "tableExport.min.js",
   "dependencies": {
-    "jquery": ">=1.9.1",
+    "jquery": ">=3.2.1",
     "file-saver": ">=2.0.1",
     "html2canvas": ">=1.0.0",
     "jspdf": ">=2.0.0",
     "pdfmake": "^0.1.71",
     "xlsx": ">=0.16.0"
diff --git a/tableExport.js b/tableExport.js
index ebf57c5..a8f25d3 100644
--- a/tableExport.js
+++ b/tableExport.js
@@ -1,9 +1,9 @@
 /**
  * @preserve tableExport.jquery.plugin
  *
- * Version 1.22.0
+ * Version 1.25.0
  *
  * Copyright (c) 2015-2022 hhurz,
  *   https://github.com/hhurz/tableExport.jquery.plugin
  *
  * Based on https://github.com/kayalshri/tableExport.jquery.plugin
diff --git a/tableExport.min.js b/tableExport.min.js
index 356ad4d..1ccbb19 100644
--- a/tableExport.min.js
+++ b/tableExport.min.js
@@ -1,9 +1,9 @@
 /**
  * @preserve tableExport.jquery.plugin
  *
- * Version 1.22.0
+ * Version 1.25.0
  *
  * Copyright (c) 2015-2022 hhurz,
  *   https://github.com/hhurz/tableExport.jquery.plugin
  *
  * Based on https://github.com/kayalshri/tableExport.jquery.plugin

Vulnerable code:   "version": "1.22.0",
  "version": "1.22.0",
    "jquery": ">=1.9.1",
 * Version 1.22.0
 * Version 1.22.0
Fixed code:   "version": "1.25.0",
  "version": "1.25.0",
    "jquery": ">=3.2.1",
 * Version 1.25.0
 * Version 1.25.0
CVE-2011-5018: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-01-08T23:15Z
Repository: https://github.com/koala-framework/koala-framework
Language: PHP
Files changed: Kwf/Exception/Abstract.php
Commit date: 2011-11-21 11:48:12 +0100
Commit message: fix XSS security issue: escape request_uri in 404 pages

Diff: diff --git a/Kwf/Exception/Abstract.php b/Kwf/Exception/Abstract.php
index d447cf583..6da4ece72 100644
--- a/Kwf/Exception/Abstract.php
+++ b/Kwf/Exception/Abstract.php
@@ -72,11 +72,11 @@ abstract class Kwf_Exception_Abstract extends Exception
 
         $view = Kwf_Debug::getView();
         $view->exception = $this->getException();
         $view->message = $this->getException()->getMessage();
         $view->requestUri = isset($_SERVER['REQUEST_URI']) ?
-            $_SERVER['REQUEST_URI'] : '' ;
+            htmlspecialchars($_SERVER['REQUEST_URI']) : '' ;
         $view->debug = Kwf_Exception::isDebug();
         $header = $this->getHeader();
         $template = $this->getTemplate();
         $template = strtolower(Zend_Filter::filterStatic($template, 'Word_CamelCaseToDash').'.tpl');
         $this->log();

Vulnerable code:             $_SERVER['REQUEST_URI'] : '' ;
Fixed code:             htmlspecialchars($_SERVER['REQUEST_URI']) : '' ;
CVE-2023-37474: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-07-14T20:15Z
Repository: https://github.com/9001/copyparty
Language: Python
Files changed: copyparty/httpcli.py
Commit date: 2023-07-14 15:55:49 +0000
Commit message: fix traversal vulnerability GHSA-pxfv-7rr3-2qjg:
the /.cpr endpoint allowed full access to server filesystem,
unless mitigated by prisonparty

Diff: diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 5de3da00..e23f5fc9 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -40,10 +40,11 @@ from .util import (
     META_NOBOTS,
     MultipartParser,
     Pebkac,
     UnrecvEOF,
     alltrace,
+    absreal,
     atomic_move,
     exclude_dotfiles,
     fsenc,
     gen_filekey,
     gen_filekey_dbg,
@@ -777,11 +778,18 @@ class HttpCli(object):
                 loc = self.args.mpmc.rstrip("/") + self.vpath[self.vpath.rfind("/") :]
                 h = {"Location": loc, "Cache-Control": "max-age=39"}
                 self.reply(b"", 301, headers=h)
                 return True
 
-            static_path = os.path.join(self.E.mod, "web/", self.vpath[5:])
+            path_base = os.path.join(self.E.mod, "web")
+            static_path = absreal(os.path.join(path_base, self.vpath[5:]))
+            if not static_path.startswith(path_base):
+                t = "attempted path traversal [{}] => [{}]"
+                self.log(t.format(self.vpath, static_path), 1)
+                self.tx_404()
+                return False
+
             return self.tx_file(static_path)
 
         if "cf_challenge" in self.uparam:
             self.reply(self.j2s("cf").encode("utf-8", "replace"))
             return True

Vulnerable code:             static_path = os.path.join(self.E.mod, "web/", self.vpath[5:])
Fixed code:     absreal,
            path_base = os.path.join(self.E.mod, "web")
            static_path = absreal(os.path.join(path_base, self.vpath[5:]))
            if not static_path.startswith(path_base):
                t = "attempted path traversal [{}] => [{}]"
                self.log(t.format(self.vpath, static_path), 1)
                self.tx_404()
                return False
CVE-2022-0699: Double Free (CWE-415)
value: A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2022-10-17T16:15Z
Repository: https://github.com/OSGeo/shapelib
Language: C
Files changed: contrib/shpsort.c
Commit date: 2022-01-03 12:34:41 +0100
Commit message: Remove double free() in contrib/shpsrt, issue #39

This fixes issue #39
Diff: diff --git a/contrib/shpsort.c b/contrib/shpsort.c
index e21e9e0..920cd8c 100644
--- a/contrib/shpsort.c
+++ b/contrib/shpsort.c
@@ -111,11 +111,10 @@ static char ** split(const char *arg, const char *delim) {
     if (!tmp) {
       while (i > 0) {
 	free(result[--i]);
       }
       free(result);
-      free(copy);
       return NULL;
     }
     result = tmp;
     result[i++] = NULL;
   }

Vulnerable code:       free(copy);