Intel® Software Guard Extensions (SGX) – Incorrect Check Vulnerability

Number: AV17-119
Date: 09 August 2017

Purpose

The purpose of this advisory is to bring attention to a vulnerability VulnerabilityA flaw or weakness in the design or implementation of an information system or its environment that could be exploited to adversely affect an organization's assets or operations. in Intel® Software Guard GuardA gateway that is placed between two networks, computers, or other information systems that operate at different security levels. The guard mediates all information transfers between the two levels so that no sensitive information from the higher security level is disclosed to the lower level. It also protects the integrity of data on the higher level. Extensions (SGX).

Assessment

CCIRC is aware of an incorrect check vulnerability in Intel® Software Guard Extensions (SGX) in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families. This privilege escalation vulnerability could allow an unprivileged user to compromise CompromiseThe intentional or unintentional disclosure of information, which adversely impacts its confidentiality, integrity, or availability. system firmware via incorrect early system state.

Suggested Action

CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.

References:

Intel® Software Guard Extensions (SGX) Incorrect Check Vulnerability
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076&languageid=en-fr