Privilege escalation in Intel SGX SDK

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU57596

Risk: Low

CVSSv3.1: 7.1 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0186

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local administrator to escalate privileges on the system.

The vulnerability exists due to improper input validation in the Intel SGX SDK applications compiled for SGX2 enabled processors, which leads to security restrictions bypass and privilege escalation.

This vulnerability affects the following Intel Processors supporting SGX2:

Ice Lake Xeon-SP (HCC, XCC) - 3rd Gen Intel® Xeon® Scalable processor famil

Ice Lake - 10th Generation Intel® Core™ Processor Famil

Gemini Lake - Intel® Pentium® Processor Silver Series, Intel® Celeron® Processor J Series, Intel® Celeron® Processor N Serie

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Software Guard Extensions (SGX) Software Development Kit (SDK) for Windows: 2.12

Software Guard Extensions (SGX) Software Development Kit (SDK) for Linux: 2.13

CPE2.3
External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00548.html

..

Support the originator by clicking the read the rest link below.