PT-2021-15667 · Apache · Apache Teaclave Rust Sgx Sdk

Published 2021-07-14 · Updated 2022-05-13 · CVE-2021-24117

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Teaclave Rust SGX SDK version 1.1.3

Description: A side-channel vulnerability in base64 PEM file decoding allows system-level attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.

Recommendations: For Apache Teaclave Rust SGX SDK version 1.1.3, consider disabling the base64 PEM file decoding functionality until a patch is available to prevent potential exploitation. Restrict access to sensitive RSA keys to minimize the risk of information disclosure.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-24117

Affected Products

Apache Teaclave Rust Sgx Sdk

References · 6

• 🔥 https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md · Exploit
• https://github.com/dingelish/rust-base64/commit/a554b7ae880553db6dde8a387101a093911d5b2a · Patch
• https://osv.dev/vulnerability/CVE-2021-24117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24117 · Security Note
• https://t.me/cvenotify/17597 · Telegram Post
• https://docs.rs/crate/sgx_tstd/1.1.1 · Note