PT-2021-5090 · Intel · Intel Sgx Sdk

Jinhua Cui + 3 · Published 2021-10-12 · Updated 2021-11-23 · CVE-2021-0186

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel(R) SGX SDK versions prior to 2.13 for Windows and 2.14 for Linux

Description The issue is related to improper input validation in Intel(R) SGX SDK applications compiled for SGX2 enabled processors, which may allow a privileged user to potentially escalate privileges via local access. This vulnerability can be exploited to access sensitive information inside protected enclaves and even execute arbitrary code on vulnerable systems. The vulnerability is associated with the Software Guard eXtensions (SGX) technology in Intel processors.

Recommendations For Intel(R) SGX SDK versions prior to 2.13 for Windows and 2.14 for Linux, update to version 2.13 for Windows or 2.14 for Linux to resolve the issue. As a temporary workaround, consider restricting access to sensitive information inside protected enclaves until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-264

CWE-20

Related Identifiers

BDU:2021-05872

CVE-2021-0186

Affected Products

Intel Sgx Sdk

References · 10

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00548.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05872 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0186 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021102136 · Note
• https://t.me/cybersecuritytechnologies/4583 · Telegram Post
• https://t.me/poxek/22 · Telegram Post
• https://xakep.ru/2021/10/21/smashex · Note
• https://t.me/cibsecurity/32562 · Telegram Post
• https://t.me/thehackernews/1597 · Telegram Post