Intel SGX / dynamic voltage and frequency scaling interface: Undervolting the CPU through the privileged

CVSS 6.7CVE-2019-11157Firmware, BMC & network fabricPlundervoltV0ltPwncurated

Impact

Undervolting the CPU through the privileged voltage-scaling MSR induces faults inside SGX enclaves, which is enough to extract AES keys and to corrupt RSA-CRT signatures into key-recovering faulty signatures. The attacker is the host operator - which is precisely the party SGX is supposed to be defended against - so this collapses confidential compute on the affected generations.

Who can reach it

Privileged local access on the host (ring 0). That is the SGX threat model: the platform owner attacking a tenant's enclave, or a compromised hypervisor attacking a confidential workload.

What to do

BIOS/firmware update that locks the undervolting MSR, and a TCB recovery: enclaves must re-attest against the new SVN and any secrets sealed under the old TCB should be considered compromised. Because the lock is applied by platform firmware, this needs an OEM BIOS release and a full drain-and-reboot per node - OEM availability historically lagged Intel's advisory by months on server boards.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-11157 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.