CVE-2020-8940

CVE-2020-8940 is an arbitrary memory read vulnerability affecting Google Asylo versions up to 0.6.0. An attacker can exploit this by manipulating the result parameter in the enc_untrusted_recvmsg call, leading to the reading of memory outside the intended buffer, including sensitive data within the secure enclave. This vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low attack complexity and no user interaction required. The primary impact is a high confidentiality breach, as an attacker can read sensitive memory locations. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.