{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"Attack on Intel SGX allowing the extraction of confidential data or execution of code within the enclave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from the Defense Science and Technology University of the People's Liberation Army of China, the National University of Singapore, and the Swiss Federal Institute of Technology Zurich have developed a new attack method on isolated Intel SGX (Software Guard eXtensions) enclaves. The attack, named SmashEx, arises from reentrancy issues while handling exceptions during the operation of runtime components for Intel SGX. The proposed attack method allows, with control over the operating system, the identification of confidential data stored in the enclave or facilitates copying of one's code into the enclave's memory and its execution. <\/p>\n

Prototypes of exploits have been prepared for enclaves with runtime based on Intel SGX SDK (CVE-2021-0186) and Microsoft Open Enclave (CVE-2021-33767). In the first case, the ability to extract the RSA key used on the web server for HTTPS has been demonstrated, while in the second case, the content retrieved by the cURL utility, running inside the enclave, has been identified. The vulnerability has already been patched programmatically in Intel SGX SDK versions 2.13 and Open Enclave 0.17.1. In addition to Intel SGX SDK and Microsoft Open Enclave packages, the vulnerability is also present in Google Asylo SDK, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX, and Veracruz. <\/p>\n

Let's recall that the SGX (Software Guard Extensions) technology emerged in Intel Core processors of the sixth generation (Skylake) and offers a series of instructions that allow user-level applications to allocate secure memory areas\u2014enclaves\u2014whose content cannot be read or modified even by the kernel or code executing in ring0, SMM, and VMM modes. Transferring control to code inside the enclave is impossible through traditional jump functions and manipulations with registers and the stack\u2014newly created instructions EENTER, EEXIT, and ERESUME, which perform privilege checks, are used for control transfer to the enclave. Additionally, code placed in the enclave can use standard calling methods to invoke functions within the enclave and a special instruction to call external functions. To protect against hardware attacks, such as connections to the DRAM module, enclave memory is encrypted.

\"Attack<\/center> <\/p>\n

The problem arises from the fact that the SGX technology allows the operating system to interrupt the execution of enclaves by generating a hardware exception, and enclaves do not properly implement primitives for atomic handling of such exceptions. Unlike the operating system kernel and regular applications, code within enclaves does not have access to primitives for organizing atomic actions during the handling of asynchronously occurring exceptions. Without these atomic primitives, an enclave can be interrupted at any time and returned to execution, even during critical sections when it is in an unsafe state (for example, when CPU registers are not saved\/restored).

\"Attack<\/center> <\/p>\n

For proper functioning, the SGX technology allows the interruption of enclave execution by customizable hardware exceptions. This feature enables enclave runtime environments to implement handling of intra-enclave exceptions or signal handling, but it can also provoke reentrancy errors. The SmashEx attack relies on exploiting shortcomings in the SDK that lead to improper handling of the situation of a recurring call to the exception handler. Importantly, to exploit the vulnerability, the attacker must be able to interrupt enclave execution, i.e., they must control the operation of the system environment. <\/p>\n

After generating an exception, the attacker has a small time window during which they can intercept the execution flow by manipulating input parameters. In particular, with access to the system (the environment outside the enclave), it is possible to create a new exception immediately after executing the enclave entry instruction (EENTER), which will lead to the return of control to the system at a stage when the enclave stack setup has not yet been completed, including the preservation of CPU register states. <\/p>\n

The system can then return control back to the enclave, but since the enclave's stack was not set up during the interrupt, the enclave will execute with a stack located in system memory, which can be exploited using return-oriented programming (ROP) techniques. In this ROP technique, the attacker does not attempt to place their own code in memory but instead operates using existing pieces of machine instructions in loaded libraries that end with a return control instruction (typically, this is the end of library functions). The exploit works by constructing a chain of calls to such blocks (called 'gadgets') to achieve the desired functionality.

\"Attack<\/center>
\"Attack<\/center>
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attack on Intel SGX that allows extraction of confidential data or execution of code in the enclave | ProHoster","description":"Researchers from the Defense Science and Technology University of the People's Liberation Army of China, the National University of Singapore, and the Swiss Federal Institute of Technology Zurich have developed a new attack method against.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}