CVE-2021-36219

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82	Patch Third Party Advisory
https://github.com/skalenetwork/sgxwallet/releases	Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:skale:sgxwallet:1.58.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-09-27 14:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-36219

Mitre link : CVE-2021-36219

CVE.ORG link : CVE-2021-36219

JSON object : View

Products Affected

skale

sgxwallet

CWE

CWE-824

Access of Uninitialized Pointer

{"id": "CVE-2021-36219", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-09-27T14:15:08.537", "references": [{"url": "https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/skalenetwork/sgxwallet/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-824"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0."}, {"lang": "es", "value": "Se ha detectado un problema en SKALE sgxwallet versi\u00f3n 1.58.3. La entrada proporcionada para ECALL 14 desencadena una rama en trustedEcdsaSign que libera un puntero no inicializado de la pila. Un atacante puede encadenar m\u00faltiples llamadas de enclave para preparar una pila que contenga una direcci\u00f3n v\u00e1lida. Esta direcci\u00f3n es entonces liberada, resultando en una integridad comprometida del enclave. Esto se resolvi\u00f3 despu\u00e9s de la v1.58.3 y no es reproducible en sgxwallet versi\u00f3n v1.77.0"}], "lastModified": "2021-10-01T22:19:17.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:skale:sgxwallet:1.58.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB490637-105D-41DF-9664-A8E5542D9D42"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}