PT-2018-16101 · Intel · Intel Sgx Sdk

Published 2018-03-20 · Updated 2018-04-18 · CVE-2018-3626

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intel SGX SDK versions prior to 2.1.2 (Linux) and 1.9.6 (Windows)

Description The Edger8r tool in the Intel SGX SDK may generate code that is susceptible to a side channel, potentially allowing a local user to access unauthorized information.

Recommendations For versions prior to 2.1.2 (Linux), update to version 2.1.2 or later. For versions prior to 1.9.6 (Windows), update to version 1.9.6 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-3626

Affected Products

Intel Sgx Sdk

References · 4

• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00117&languageid=en-fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3626 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3626 · Vendor Advisory
• http://securityfocus.com/bid/103479 · Note