CVE-2020-8904

CVE-2020-8904 is an arbitrary memory overwrite vulnerability affecting Google Asylo versions prior to 0.6.0. This critical vulnerability, with a CVSS score of 9.6, allows an authenticated attacker to write to arbitrary locations within the trusted enclave memory due to insufficient validation of the output_len pointer in the ecall_restore function. Such an exploit could lead to high impact on both integrity and availability of the system. While no active exploitation, public exploit code, or significant community discussion has been observed, updating Asylo to version 0.6.0 or later is strongly recommended to mitigate this severe risk.