PT-2023-14943 · Intel · Scone

Published 2023-12-29 · Updated 2024-01-08 · CVE-2022-46486

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SCONE versions prior to 5.8.0

Description A lack of pointer-validation logic in the scone dispatch component of SCONE for Intel SGX allows attackers to access sensitive information.

Recommendations For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the scone dispatch component until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-763

Related Identifiers

CVE-2022-46486

Affected Products

Scone

References · 9

• 🔥 https://jovanbulck.github.io/files/oakland24-pandora.pdf · Exploit
• 🔥 https://jovanbulck.github.io/files/ccs19-tale.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2022-46486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46486 · Security Note
• https://t.me/cvenotify/66595 · Telegram Post
• https://twitter.com/CVEnew/status/1740925894234136886 · Twitter Post
• https://t.me/cvenotify/65882 · Telegram Post
• https://t.me/cibsecurity/74016 · Telegram Post
• https://sconedocs.github.io/release5.7 · Note