Intel processors / SGX (load value injection): The inverse of Meltdown: instead of leaking data out of the enclave, the

CVSS 5.6CVE-2020-0551Firmware, BMC & network fabricLVILoad Value Injectioncurated

Impact

The inverse of Meltdown: instead of leaking data out of the enclave, the attacker injects a value into a faulting load inside the victim enclave and steers its transient execution into attacker-chosen gadgets. That gives enclave-secret extraction from outside the enclave, again breaking the SGX guarantee against a privileged host.

Who can reach it

Local privileged code on the host targeting a victim enclave on the same machine.

What to do

SGX SDK/PSW update that inserts LFENCE serialisation in enclave code, plus microcode. The software mitigation requires recompiling enclaves with the patched SDK - a code change for whoever ships the enclave, not something the operator can apply unilaterally - and it carries a heavy performance cost. Microcode is late-loadable at boot; enclave recompilation is not. Re-attestation required.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-0551 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00334.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.