Frank Piessens

The issue is related to insufficient input validation in the Intel SGX DCAP software, which may allow an authenticated user to potentially enable information disclosure via local access.

The issue concerns two problems in the Open Enclave SDK. First, it does not properly sanitize the `MXCSR` register on enclave entry, making applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks. This could impact instruction retirement by at most one cycle, depending on the secret data operand value. Second, the SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry, allowing a side-channel attacker to be notified for every unaligned memory access performed by the enclave.

The issue is related to an improper conditions check in the Intel(R) SGX SDK software. This may allow a privileged user to potentially enable information disclosure via local access.

The issue is related to insufficient control flow management, which may allow an authenticated user to potentially enable information disclosure via local access.

The issue concerns the pointer-validation logic in Occlum for Intel SGX, which can act as a confused deputy. This allows a local attacker to access unauthorized information via side-channel analysis.

A time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via network access.

The issue affects enclaves that use x87 FPU operations, making them vulnerable to tampering by a malicious host application. This is due to the violation of the Linux System V Application Binary Interface (ABI) for such operations, allowing a host app to compromise the execution integrity of some x87 FPU operations in an enclave. Depending on the FPU control configuration of the enclave app and whether the operations are used in secret-dependent execution paths, this may also be used to mount a side-channel attack on the enclave.

The issue is related to an error in handling objects in memory, which can be exploited by a remote attacker to gain unauthorized access to protected information. This is an information disclosure issue that arises from improper handling of objects in memory.

The issue is related to the implementation of Intel Software Guard Extensions (SGX) technology and speculative execution in microprocessors. It may allow unauthorized disclosure of information from an enclave to an attacker with local user access via a side-channel analysis. This can enable an attacker to read data from the L1 cache, which may contain fragments of data from the protected area after speculative execution.