David Oswald

The issue is related to insufficient input validation in the Intel SGX DCAP software, which may allow an authenticated user to potentially enable information disclosure via local access.

The issue concerns two problems in the Open Enclave SDK. First, it does not properly sanitize the `MXCSR` register on enclave entry, making applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks. This could impact instruction retirement by at most one cycle, depending on the secret data operand value. Second, the SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry, allowing a side-channel attacker to be notified for every unaligned memory access performed by the enclave.

The issue is related to insufficient control flow management, which may allow an authenticated user to potentially enable information disclosure via local access.

The issue is related to an improper conditions check in the Intel(R) SGX SDK software. This may allow a privileged user to potentially enable information disclosure via local access.

The issue concerns the pointer-validation logic in Occlum for Intel SGX, which can act as a confused deputy. This allows a local attacker to access unauthorized information via side-channel analysis.

A time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via network access.

Name of the Vulnerable Software and Affected Versions: SDP SDK versions prior to SMR JUN-2021 Release 1 Description: The issue is related to improper authorization, which allows access to internal storage. Recommendations: For versions prior to SMR JUN-2021 Release 1, update to SMR JUN-2021 Release 1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Oct-2020 Release 1 Description: The issue is related to an improper authorization of using a debugging command in Secure Folder, which allows unauthorized access to contents in Secure Folder via the debugging command. Recommendations: For versions prior to SMR Oct-2020 Release 1, update to SMR Oct-2020 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the debugging command to minimize the risk of exploitation.

The issue is related to a privilege escalation vulnerability due to design defects. An attacker needs physical contact with the mobile phone to obtain higher privileges and execute relevant commands, resulting in the user's privilege promotion.

The issue allows guest OS administrators to obtain sensitive information, such as AES keys from outside the guest, via a side-channel attack on a power/energy monitoring interface, also known as a "Platypus" attack.

The issue affects enclaves that use x87 FPU operations, making them vulnerable to tampering by a malicious host application. This is due to the violation of the Linux System V Application Binary Interface (ABI) for such operations, allowing a host app to compromise the execution integrity of some x87 FPU operations in an enclave. Depending on the FPU control configuration of the enclave app and whether the operations are used in secret-dependent execution paths, this may also be used to mount a side-channel attack on the enclave.

The issue is related to an error in handling objects in memory, which can be exploited by a remote attacker to gain unauthorized access to protected information. This is an information disclosure issue that arises from improper handling of objects in memory.