Arbitrary enclave memory location write from untrusted environment

Vulnerability

An arbitrary memory overwrite vulnerability exists in Asylo versions up to and including 0.6.0. The host call enc_untrusted_create_wait_queue uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate that the pointer resides in untrusted memory. This allows an attacker to write memory values from within the enclave.

Exploitation

An attacker running code inside the enclave can call enc_untrusted_create_wait_queue with a crafted pointer that points to arbitrary memory within the enclave. The function then uses UntrustedLocalMemcpy to copy data to that pointer, overwriting arbitrary memory.

Impact

Successful exploitation allows the attacker to write arbitrary memory values from within the enclave, potentially leading to privilege escalation, data corruption, or arbitrary code execution within the enclave's security context.

Mitigation

The issue is fixed in commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 [1]. Users should upgrade to a version beyond 0.6.0 containing this fix. No workaround is available for versions prior to the patch.