LiveActive security incident?Get immediate response
CVE Record

CVE-2020-11105: An issue was discovered in USC iLab cereal through 1.3.0.

An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is allocated at the same address. Serialization fidelity thereby becomes dependent upon memory layout. In short, serialized std::shared_ptr variables cannot always be expected to serialize back into their original values. This can have any number of consequences, depending on the context within which this manifests.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-11105 is a data integrity flaw in USC iLab cereal through 1.3.0. Under some memory reuse conditions, shared pointer serialization may not round-trip to the original values. Business impact depends entirely on what the affected application stores, restores, or trusts through cereal serialization.

Executive priority

Treat this as a targeted engineering review item, not an emergency, unless cereal serialization supports critical business logic or security decisions. Prioritize asset discovery and impact analysis because the public record does not quantify severity or name a confirmed fix.

Technical view

cereal caches std::shared_ptr values using the raw pointer address as a unique identifier. If a shared_ptr is freed and another is later allocated at the same address, serialization fidelity can depend on memory layout. The CVE provides no CVSS, CWE, patch detail, or standardized affected CPEs.

Likely exposure

Exposure is likely limited to software that embeds or depends on USC iLab cereal through 1.3.0 and serializes std::shared_ptr values. The source bundle does not identify downstream products, packaged distributions, or vulnerable deployment patterns.

Exploitation context

The provided sources do not show CISA KEV listing, active exploitation, exploit code, or weaponized public use. The risk is context-dependent: it may be minor data corruption in some applications or serious integrity failure where serialized state drives security or safety decisions.

Researcher notes

Key uncertainty is exploitability in real applications. The root issue is pointer identity caching based on raw addresses, creating nondeterministic serialization behavior after allocator reuse. Analyze application-specific trust boundaries and consequences; the CVE record itself does not establish remote attackability.

Mitigation direction

  • Inventory applications and vendored code using USC iLab cereal through 1.3.0.
  • Check USC iLab cereal guidance before selecting an upgrade or patch path.
  • Review affected serialization paths before trusting restored shared_ptr-backed data.
  • Add regression tests for shared_ptr serialization round trips in affected applications.

Validation and detection

  • Search dependency manifests and vendored source for cereal versions through 1.3.0.
  • Identify code paths that serialize std::shared_ptr or pointer-linked object graphs.
  • Review whether restored serialized state affects authorization, configuration, safety, or transactions.
  • Run application-level round-trip tests for shared_ptr serialization correctness.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-11105 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.