CVE-2020-8904: Google Asylo

Critical severity, CVSS 9.6. EPSS: 0.2% chance of exploitation in the next 30 days.

An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.

Affected products

• Google Asylo: before 0.6.0 (fixed in 0.6.0)

Published 2020-08-12. Last modified 2026-06-17.