CVE-2021-36219: skale sgxwallet

csirt@kutim:~/threat-intel/cve/CVE-2021-36219

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Access of Uninitialized Pointer pada skale sgxwallet. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.

Rincian

Terbit di NVD: 27 September 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-824: Access of Uninitialized Pointer
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
skale	sgxwallet	Versi 1.58.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82 patch · advisory pihak ketiga
https://github.com/skalenetwork/sgxwallet/releases release notes · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.