Out-of-bounds read in Open Enclave SDK - #VU159492

Vulnerability details

The vulnerability allows an attacker to trigger an out-of-bounds read in the Open Enclave SDK by supplying a malicious SGX quote buffer for parsing.

The vulnerability exists due to unguarded pointer arithmetic and subsequent reads from an attacker-controlled SGX quote buffer in _parse_quote(). A remote attacker can trigger the out-of-bounds read if they can cause the affected SDK to parse a crafted SGX quote buffer containing specific sizes and values.

The affected functionality is SGX quote parsing, implemented in common/sgx/quote.c in the Open Enclave SDK. The reported failure is a read beyond the bounds of the supplied quote buffer.

Affected software

Remediation

External References

• https://github.com/openenclave/openenclave/security/advisories/GHSA-cpr6-5fw2-32xx

Related Security Bulletins

• Multiple vulnerabilities in Open Enclave SDK