Change language

Researchers talk about AEPIC Leak attack that leaks keys from Intel SGX enclaves and show exploit code

A group of researchers from the Institute for Applied Information Processing and Communications (IAIK) at the Graz University of Technology spoke about an AEPIC Leak attack that leaked confidential data from isolated enclaves of Intel SGX (Software Guard eXtensions).

See also: Best laptop for hacking

The researchers named the new attack vector AEPIC Leak (ÆPIC Leak). This is a vulnerability in the Advanced Programmable Interrupt Controller (APIC), which is responsible for prioritizing and sending interprocessor interrupts.

IAIK research has determined that CVE-2022-21233 is caused by an architectural flaw that allows access to uninitialized data left in APIC registers from past operations.

An AEPIC Leak attack requires administrator or root access to APIC MMIO. The experts found out and showed in two demos (1, 2) that the new attack poses a serious threat to applications that use Intel SGX technology in their work.

Experts have published a test sample of the exploit code for this vulnerability on GitHub. “It is enough to load the application into memory to be able to merge its contents. AEPIC Leaks can accurately attack a program and take a complete dump of its memory. This process happens in a second,” explained the researcher from IAIK.

Developers from Intel are aware of the problem. The company assigned it a medium level of danger and explained its occurrence by improper isolation of shared resources in Intel SGX enclaves. The issue does not affect processors without SGX support. The manufacturer has published a list of attacked processors (access from Russia only via VPN): Intel Ice Lake 10th generation, Intel Xeon 3rd generation (Ice Lake SP), Ice Lake Xeon-SP, Ice Lake D, Gemini Lake, Ice Lake (U, Y) and Rocket Lake. Intel is preparing microcode updates against this vulnerability. Intel advises operating system and hypervisor developers to enable x2APIC mode instead of xAPIC in their temporary workaround.

Shop

Learn programming in R: courses

$

Best Python online courses for 2022

$

Best laptop for Fortnite

$

Best laptop for Excel

$

Best laptop for Solidworks

$

Best laptop for Roblox

$

Best computer for crypto mining

$

Best laptop for Sims 4

$

Latest questions

NUMPYNUMPY

psycopg2: insert multiple rows with one query

12 answers

NUMPYNUMPY

How to convert Nonetype to int or string?

12 answers

NUMPYNUMPY

How to specify multiple return types using type-hints

12 answers

NUMPYNUMPY

Javascript Error: IPython is not defined in JupyterLab

12 answers

News


Wiki

Python OpenCV | cv2.putText () method

numpy.arctan2 () in Python

Python | os.path.realpath () method

Python OpenCV | cv2.circle () method

Python OpenCV cv2.cvtColor () method

Python - Move item to the end of the list

time.perf_counter () function in Python

Check if one list is a subset of another in Python

Python os.path.join () method