SgxSpectre Attack Can Extract Data from Intel SGX Enclaves

itman · Mar 3, 2018

More bad news for Intel processor users.

A new variation of the Spectre attack has been revealed this week by six scientists from the Ohio State University. Named SgxSpectre, researchers say this attack can extract information from Intel SGX enclaves.

Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more.

SgxSpectre attacks code patterns in SGX SDKs

But neither Meltdown and Spectre were able to extract data from SGX enclaves. This is where SgxSpectre comes in.

According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to add SGX support to their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX.

Updates coming for the Intel SGX SDK

Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16.

App developers will need to integrate this new SDK version into their SGX-capable apps and issue an update to users.

Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.
Click to expand...

https://www.bleepingcomputer.com/ne...ack-can-extract-data-from-intel-sgx-enclaves/

reasonablePrivacy · Mar 3, 2018

Intel SGX is new technology and very rarely used. Nothing to worry about for average user.

Log in or Sign up

SgxSpectre Attack Can Extract Data from Intel SGX Enclaves

itman Registered Member

reasonablePrivacy Registered Member

Log in or Sign up

SgxSpectre Attack Can Extract Data from Intel SGX Enclaves

itman Registered Member

reasonablePrivacy Registered Member

Useful Searches