CVE-2021-22552

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-126CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-225537.5Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically disposCVE-2021-225557.8A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain priCVE-2021-225567.8The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operatioCVE-2021-225577.8SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SCVE-2021-225610.0Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporteCVE-2021-225634.4Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read CVE-2021-225645.5For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups ouCVE-2021-225656.5An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs CVE-2021-225669.8An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprCVE-2021-225673.5Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefariouCVE-2021-225688.8When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauCVE-2021-225695.5An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out o