rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
Vulnerability ID: CVE-2020-7206
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/HewlettPackard/nagios-plugins-hpilo
Published: 2020-07-17
File: action-url/nagios_hpeilo_service_details.php
Commit message: Merge pull request #8 from dchangtw/1.5.0

CVE-2020-7206: Fix php code injection problem
Commit author: pmschoeller

Vulnerable version (before fix):
         $ip=$_GET["ip"];         $comm=$_GET["comm"];         $id=$_GET["id"];         $cmd="./nagios_hpeilo_engine -H $ip -C $comm -o $id -J";         $ret = exec($cmd,$output);         echo join("\n",$output); ?>

Fixed version (after fix):
         $ip=$_GET["ip"];         $comm=$_GET["comm"];         $id=$_GET["id"];         $cmd=escapeshellcmd("./nagios_hpeilo_engine -H $ip -C $comm -o $id -J");         $ret = exec($cmd,$output);         echo join("\n",$output); ?>

Patch:
patch: @@ -22,7 +22,7 @@
         $ip=$_GET["ip"];
         $comm=$_GET["comm"];
         $id=$_GET["id"];
-        $cmd="./nagios_hpeilo_engine -H $ip -C $comm -o $id -J";
+        $cmd=escapeshellcmd("./nagios_hpeilo_engine -H $ip -C $comm -o $id -J");
         $ret = exec($cmd,$output);
         echo join("\n",$output);
 ?>
path: action-url/nagios_hpeilo_service_details.php
Vulnerability: The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.
Vulnerability ID: CVE-2020-8036
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/the-tcpdump-group/tcpdump
Published: 2020-11-04
File: print-someip.c
Commit message: SOME/IP: Fix terminating a "struct tok" array

Moreover:
Declare static and const the "struct tok" arrays.
Commit author: Francois-Xavier Le Bail

Vulnerable version (before fix):
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  */  struct tok message_type_values[] = {     { 0x00, "REQUEST" },     { 0x01, "REQUEST_NO_RETURN" },     { 0x02, "NOTIFICATION" }, struct tok message_type_values[] = {     { 0, NULL } };  struct tok return_code_values[] = {     { 0x00, "E_OK" },     { 0x01, "E_NOT_OK" },     { 0x02, "E_UNKNOWN_SERVICE" }, struct tok return_code_values[] = {     { 0x0d, "E_E2E" },     { 0x0e, "E_E2E_NOT_AVAILABLE" },     { 0x0f, "E_E2E_NO_NEW_DATA" }, };  void

Fixed version (after fix):
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  */  static const struct tok message_type_values[] = {     { 0x00, "REQUEST" },     { 0x01, "REQUEST_NO_RETURN" },     { 0x02, "NOTIFICATION" }, struct tok message_type_values[] = {     { 0, NULL } };  static const struct tok return_code_values[] = {     { 0x00, "E_OK" },     { 0x01, "E_NOT_OK" },     { 0x02, "E_UNKNOWN_SERVICE" }, struct tok return_code_values[] = {     { 0x0d, "E_E2E" },     { 0x0e, "E_E2E_NOT_AVAILABLE" },     { 0x0f, "E_E2E_NO_NEW_DATA" },     { 0, NULL } };  void

Patch:
patch: @@ -42,7 +42,7 @@
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
 
-struct tok message_type_values[] = {
+static const struct tok message_type_values[] = {
     { 0x00, "REQUEST" },
     { 0x01, "REQUEST_NO_RETURN" },
     { 0x02, "NOTIFICATION" },
@@ -56,7 +56,7 @@ struct tok message_type_values[] = {
     { 0, NULL }
 };
 
-struct tok return_code_values[] = {
+static const struct tok return_code_values[] = {
     { 0x00, "E_OK" },
     { 0x01, "E_NOT_OK" },
     { 0x02, "E_UNKNOWN_SERVICE" },
@@ -73,6 +73,7 @@ struct tok return_code_values[] = {
     { 0x0d, "E_E2E" },
     { 0x0e, "E_E2E_NOT_AVAILABLE" },
     { 0x0f, "E_E2E_NO_NEW_DATA" },
+    { 0, NULL }
 };
 
 void
path: print-someip.c
Vulnerability: XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Vulnerability ID: CVE-2020-8498
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/bradyvercher/gistpress
Published: 2020-01-30
File: includes/class-gistpress.php
Commit message: Sanitize the shortcode id attribute.
Commit author: Brady Vercher

Vulnerable version (before fix):
 protected function standardize_attributes( array $rawattr ) {  		// Sanitize attributes. 		$attr = shortcode_atts( $defaults, $rawattr ); 		$attr['embed_stylesheet']  = $this->shortcode_bool( $attr['embed_stylesheet'] ); 		$attr['show_line_numbers'] = $this->shortcode_bool( $attr['show_line_numbers'] ); 		$attr['show_meta']         = $this->shortcode_bool( $attr['show_meta'] );

Fixed version (after fix):
 protected function standardize_attributes( array $rawattr ) {  		// Sanitize attributes. 		$attr = shortcode_atts( $defaults, $rawattr ); 		$attr['id']                = preg_replace( '/[^a-z0-9]+/i', '', $attr['id'] ); 		$attr['embed_stylesheet']  = $this->shortcode_bool( $attr['embed_stylesheet'] ); 		$attr['show_line_numbers'] = $this->shortcode_bool( $attr['show_line_numbers'] ); 		$attr['show_meta']         = $this->shortcode_bool( $attr['show_meta'] );

Patch:
patch: @@ -681,6 +681,7 @@ protected function standardize_attributes( array $rawattr ) {
 
 		// Sanitize attributes.
 		$attr = shortcode_atts( $defaults, $rawattr );
+		$attr['id']                = preg_replace( '/[^a-z0-9]+/i', '', $attr['id'] );
 		$attr['embed_stylesheet']  = $this->shortcode_bool( $attr['embed_stylesheet'] );
 		$attr['show_line_numbers'] = $this->shortcode_bool( $attr['show_line_numbers'] );
 		$attr['show_meta']         = $this->shortcode_bool( $attr['show_meta'] );
path: includes/class-gistpress.php
Vulnerability: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
Vulnerability ID: CVE-2020-8597
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/paulusmack/ppp
Published: 2020-02-03
File: pppd/eap.c
Commit message: pppd: Fix bounds check in EAP code

Given that we have just checked vallen < len, it can never be the case
that vallen >= len + sizeof(rhostname).  This fixes the check so we
actually avoid overflowing the rhostname array.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Commit author: Paul Mackerras

Vulnerable version (before fix):
 int len; 		}  		/* Not so likely to happen. */ 		if (vallen >= len + sizeof (rhostname)) { 			dbglog("EAP: trimming really long peer name down"); 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); 			rhostname[sizeof (rhostname) - 1] = '\0'; int len; 		}  		/* Not so likely to happen. */ 		if (vallen >= len + sizeof (rhostname)) { 			dbglog("EAP: trimming really long peer name down"); 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); 			rhostname[sizeof (rhostname) - 1] = '\0';

Fixed version (after fix):
 int len; 		}  		/* Not so likely to happen. */ 		if (len - vallen >= sizeof (rhostname)) { 			dbglog("EAP: trimming really long peer name down"); 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); 			rhostname[sizeof (rhostname) - 1] = '\0'; int len; 		}  		/* Not so likely to happen. */ 		if (len - vallen >= sizeof (rhostname)) { 			dbglog("EAP: trimming really long peer name down"); 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); 			rhostname[sizeof (rhostname) - 1] = '\0';

Patch:
patch: @@ -1420,7 +1420,7 @@ int len;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
@@ -1846,7 +1846,7 @@ int len;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
path: pppd/eap.c
Vulnerability: A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
Vulnerability ID: CVE-2020-8637
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Published: 2020-04-03
File: lib/functions/tree.class.php
Commit message: refactoring for security (www.ackcent.com)
Commit author: Francisco Mancardi

Vulnerable version (before fix):
 function: change_parent   */   function change_parent($node_id, $parent_id)    {     $debugMsg='Class:' .__CLASS__ . ' - Method:' . __FUNCTION__ . ' :: ';     if( is_array($node_id) )     {       $id_list = implode(",",$node_id);       $where_clause = " WHERE id IN ($id_list) ";     }     else     {       $where_clause=" WHERE id = {$node_id}";     }     $sql = "/* $debugMsg */ UPDATE {$this->object_table} " .            " SET parent_id = " . $this->db->prepare_int($parent_id) . " {$where_clause}";          $result = $this->db->exec_query($sql);     

Fixed version (after fix):
 function: change_parent   */   function change_parent($node_id, $parent_id)    {     $debugMsg = 'Class:' .__CLASS__ . ' - Method:'                           . __FUNCTION__ . ' :: ';      if (is_array($node_id)) {       $safeSet = array_map('intval',$node_id);       $id_list = implode(",",$safeSet);       $where_clause = " WHERE id IN ($id_list) ";     } else {           $safe = intval($node_id);       if ($safe <= 0) {         throw new Exception("BAD node_id", 1);       }       $where_clause=" WHERE id = $safe";     }      $safeP = $this->db->prepare_int($parent_id);     $sql = "/* $debugMsg */              UPDATE {$this->object_table}             SET parent_id = $safeP              $where_clause ";          $result = $this->db->exec_query($sql);     

Patch:
patch: @@ -537,18 +537,26 @@ function: change_parent
   */
   function change_parent($node_id, $parent_id) 
   {
-    $debugMsg='Class:' .__CLASS__ . ' - Method:' . __FUNCTION__ . ' :: ';
-    if( is_array($node_id) )
-    {
-      $id_list = implode(",",$node_id);
+    $debugMsg = 'Class:' .__CLASS__ . ' - Method:' 
+                         . __FUNCTION__ . ' :: ';
+
+    if (is_array($node_id)) {
+      $safeSet = array_map('intval',$node_id);
+      $id_list = implode(",",$safeSet);
       $where_clause = " WHERE id IN ($id_list) ";
+    } else {    
+      $safe = intval($node_id);
+      if ($safe <= 0) {
+        throw new Exception("BAD node_id", 1);
+      }
+      $where_clause=" WHERE id = $safe";
     }
-    else
-    {
-      $where_clause=" WHERE id = {$node_id}";
-    }
-    $sql = "/* $debugMsg */ UPDATE {$this->object_table} " .
-           " SET parent_id = " . $this->db->prepare_int($parent_id) . " {$where_clause}";
+
+    $safeP = $this->db->prepare_int($parent_id);
+    $sql = "/* $debugMsg */ 
+            UPDATE {$this->object_table}
+            SET parent_id = $safeP 
+            $where_clause ";
     
     $result = $this->db->exec_query($sql);
path: lib/functions/tree.class.php
Vulnerability: An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
Vulnerability ID: CVE-2020-8904
CWE: CWE-119
Severity score: 4.9
Project: https://github.com/google/asylo
Published: 2020-08-12
File: asylo/platform/primitives/sgx/ecalls.cc
Commit message: Check for output_len range in ecall_restore

This may cause vulnerablity if pointing to trusted memory.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 322476223
Change-Id: I8a6406e9f07a20582d4387bd9a3469dfa9cbcb12
Commit author: Chong Cai

Vulnerable version (before fix):
 int ecall_take_snapshot(char **output, uint64_t *output_len) { int ecall_restore(const char *input, uint64_t input_len, char **output,                   uint64_t *output_len) {   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,                                                               input_len)) {     asylo::primitives::TrustedPrimitives::BestEffortAbort(         "ecall_restore: input found to not be in untrusted memory.");   }   int result = 0;   size_t tmp_output_len;

Fixed version (after fix):
 int ecall_take_snapshot(char **output, uint64_t *output_len) { int ecall_restore(const char *input, uint64_t input_len, char **output,                   uint64_t *output_len) {   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,                                                               input_len) ||       !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(           output_len, sizeof(uint64_t))) {     asylo::primitives::TrustedPrimitives::BestEffortAbort(         "ecall_restore: input/output found to not be in untrusted memory.");   }   int result = 0;   size_t tmp_output_len;

Patch:
patch: @@ -62,9 +62,11 @@ int ecall_take_snapshot(char **output, uint64_t *output_len) {
 int ecall_restore(const char *input, uint64_t input_len, char **output,
                   uint64_t *output_len) {
   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,
-                                                              input_len)) {
+                                                              input_len) ||
+      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(
+          output_len, sizeof(uint64_t))) {
     asylo::primitives::TrustedPrimitives::BestEffortAbort(
-        "ecall_restore: input found to not be in untrusted memory.");
+        "ecall_restore: input/output found to not be in untrusted memory.");
   }
   int result = 0;
   size_t tmp_output_len;
path: asylo/platform/primitives/sgx/ecalls.cc
Vulnerability: A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.
Vulnerability ID: CVE-2020-8905
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/google/asylo
Published: 2020-08-12
File: asylo/platform/host_call/trusted/host_calls.cc
Commit message: Fix vulnerability in enc_untrusted_recvfrom

Change recvfrom memcpy to check for received_buffer size to avoid
copying extra buffer.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 322476299
Change-Id: I3606ff9ec51ec7cc4312c7555c645a2fc6e09b21
Commit author: Chong Cai

Vulnerable version (before fix):
 ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,   }    auto buffer_received = output.next();   memcpy(buf, buffer_received.data(), len);    // If |src_addr| is not NULL, and the underlying protocol provides the source   // address, this source address is filled in. When |src_addr| is NULL, nothing

Fixed version (after fix):
 ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,   }    auto buffer_received = output.next();   memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));    // If |src_addr| is not NULL, and the underlying protocol provides the source   // address, this source address is filled in. When |src_addr| is NULL, nothing

Patch:
patch: @@ -982,7 +982,7 @@ ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,
   }
 
   auto buffer_received = output.next();
-  memcpy(buf, buffer_received.data(), len);
+  memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));
 
   // If |src_addr| is not NULL, and the underlying protocol provides the source
   // address, this source address is filled in. When |src_addr| is NULL, nothing
path: asylo/platform/host_call/trusted/host_calls.cc
Vulnerability: A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to restrict access in your debug environments.
Vulnerability ID: CVE-2020-8916
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/openthread/wpantund
Published: 2020-07-07
File: src/wpanctl/wpanctl.c
Commit message: [wpanctl] free dbus connection and error on exit.
Commit author: Abtin Keshavarzian

Vulnerable version (before fix):
 int main(int argc, char * argv[]) 	int c; 	bool ignore_driver_version_mismatch = false; 	DBusError error; 	DBusConnection* connection;  	dbus_error_init(&error);  int main(int argc, char * argv[]) 	if (gRet == ERRORCODE_QUIT) 		gRet = 0;  	return gRet; }

Fixed version (after fix):
 int main(int argc, char * argv[]) 	int c; 	bool ignore_driver_version_mismatch = false; 	DBusError error; 	DBusConnection* connection = NULL;  	dbus_error_init(&error);  int main(int argc, char * argv[]) 	if (gRet == ERRORCODE_QUIT) 		gRet = 0;  	if (connection) { 		dbus_connection_unref(connection); 	}  	dbus_error_free(&error);  	return gRet; }

Patch:
patch: @@ -435,7 +435,7 @@ int main(int argc, char * argv[])
 	int c;
 	bool ignore_driver_version_mismatch = false;
 	DBusError error;
-	DBusConnection* connection;
+	DBusConnection* connection = NULL;
 
 	dbus_error_init(&error);
 
@@ -715,5 +715,11 @@ int main(int argc, char * argv[])
 	if (gRet == ERRORCODE_QUIT)
 		gRet = 0;
 
+	if (connection) {
+		dbus_connection_unref(connection);
+	}
+
+	dbus_error_free(&error);
+
 	return gRet;
 }
path: src/wpanctl/wpanctl.c
Vulnerability: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
Vulnerability ID: CVE-2020-8935
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/google/asylo
Published: 2020-12-15
File: asylo/platform/host_call/trusted/host_calls.cc
Commit message: Check return pointer is outside enclave in realloc

PiperOrigin-RevId: 333769459
Change-Id: If53b5f4317080b8abaf5c4f80ce751f150630bcb
Commit author: Chong Cai

Vulnerable version (before fix):
 void *enc_untrusted_realloc(void *ptr, size_t size) {   if (!result && size != 0) {     errno = FromkLinuxErrorNumber(klinux_errno);   }   return result; } 

Fixed version (after fix):
 void *enc_untrusted_realloc(void *ptr, size_t size) {   if (!result && size != 0) {     errno = FromkLinuxErrorNumber(klinux_errno);   }    if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {     ::asylo::primitives::TrustedPrimitives::BestEffortAbort(         "enc_untrusted_realloc: realloc result should be in untrusted "         "memory");   }   return result; } 

Patch:
patch: @@ -644,6 +644,12 @@ void *enc_untrusted_realloc(void *ptr, size_t size) {
   if (!result && size != 0) {
     errno = FromkLinuxErrorNumber(klinux_errno);
   }
+
+  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_realloc: realloc result should be in untrusted "
+        "memory");
+  }
   return result;
 }
path: asylo/platform/host_call/trusted/host_calls.cc
Vulnerability: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
Vulnerability ID: CVE-2020-8935
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/google/asylo
Published: 2020-12-15
File: asylo/platform/host_call/trusted/host_calls.cc
Commit message: Check return pointer is outside enclave in realloc

PiperOrigin-RevId: 333769459
Change-Id: If53b5f4317080b8abaf5c4f80ce751f150630bcb
Commit author: Chong Cai

Vulnerable version (before fix):
 void *enc_untrusted_realloc(void *ptr, size_t size) {   if (!result && size != 0) {     errno = FromkLinuxErrorNumber(klinux_errno);   }   return result; } 

Fixed version (after fix):
 void *enc_untrusted_realloc(void *ptr, size_t size) {   if (!result && size != 0) {     errno = FromkLinuxErrorNumber(klinux_errno);   }    if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {     ::asylo::primitives::TrustedPrimitives::BestEffortAbort(         "enc_untrusted_realloc: realloc result should be in untrusted "         "memory");   }   return result; } 

Patch:
patch: @@ -644,6 +644,12 @@ void *enc_untrusted_realloc(void *ptr, size_t size) {
   if (!result && size != 0) {
     errno = FromkLinuxErrorNumber(klinux_errno);
   }
+
+  if (!::asylo::primitives::TrustedPrimitives::IsOutsideEnclave(result, size)) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_realloc: realloc result should be in untrusted "
+        "memory");
+  }
   return result;
 }
path: asylo/platform/host_call/trusted/host_calls.cc
Vulnerability: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.
Vulnerability ID: CVE-2020-8936
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/google/asylo
Published: 2020-12-15
File: asylo/platform/primitives/sgx/trusted_sgx.cc
Commit message: Verify UntrustedCall output is outside enclave

PiperOrigin-RevId: 333781703
Change-Id: I9df55c04dc8b04f4bf0bda8e68cc32bca81b933a
Commit author: Chong Cai

Vulnerable version (before fix):
 PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,   if (sgx_params->input) {     untrusted_cache->Free(const_cast<void *>(sgx_params->input));   }   if (sgx_params->output) {     // For the results obtained in |output_buffer|, copy them to |output|     // before freeing the buffer.

Fixed version (after fix):
 PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,   if (sgx_params->input) {     untrusted_cache->Free(const_cast<void *>(sgx_params->input));   }   if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,                                            sgx_params->output_size)) {     TrustedPrimitives::BestEffortAbort(         "UntrustedCall: sgx_param output should be in untrusted memory");   }   if (sgx_params->output) {     // For the results obtained in |output_buffer|, copy them to |output|     // before freeing the buffer.

Patch:
patch: @@ -288,6 +288,11 @@ PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,
   if (sgx_params->input) {
     untrusted_cache->Free(const_cast<void *>(sgx_params->input));
   }
+  if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
+                                           sgx_params->output_size)) {
+    TrustedPrimitives::BestEffortAbort(
+        "UntrustedCall: sgx_param output should be in untrusted memory");
+  }
   if (sgx_params->output) {
     // For the results obtained in |output_buffer|, copy them to |output|
     // before freeing the buffer.
path: asylo/platform/primitives/sgx/trusted_sgx.cc