Intel Xeon 6 DDRIO configuration (with SGX or TDX): MULTI-TENANT ISOLATION: An improperly implemented security check

Impact

MULTI-TENANT ISOLATION: An improperly implemented security check in DDRIO configuration on Xeon 6 lets a privileged local user escalate on SGX/TDX-enabled platforms. DDRIO sits between the memory controller and DRAM, which is the layer memory-encryption integrity depends on.

Who can reach it

Privileged local access on a Xeon 6 host with SGX or TDX enabled.

What to do

OEM platform firmware/BIOS update plus TCB recovery for both SGX and TDX. Drain, reboot, re-attest.

References