CVE-2021-36219

2021-09-2713:22:28

mitre

www.cve.org

skale sgxwallet

1.58.3

ecall 14

enclave integrity

vulnerability

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

61.8%

JSON

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.