Skip to content

Mitigating SGX Vulnerabilities

SGX Vulnerabilities

As in any complex technology, SGX has had its share of security vulnerabilities. An active research community is looking for vulnerabilities in SGX, and Intel has been fixing these issues. These security vulnerabilities have been mitigated with microcode updates as well as CPU design changes. Hence, we now have a much more hardened SGX. In particular, the new Icelake server CPUs are hardened against most of the vulnerabilities. For any remaining vulnerabilities, we can help to mitigate these with the help of SCONE.

Mitigation Mechanisms

The most important mechanism to ensure that your application is protected against known security vulnerabilities is the attestation. During application startup, the SCONE runtime and SCONE CAS attests transparently the platform on which your application is executing. Any known security vulnerabilities are detected, reported, and by default, the attestation fails with an error.

The following actions might be needed to mitigate security vulnerabilities:

  • firmware updates: most vulnerabilities can be addressed with firmware updates. In case you run your application in a cloud, your cloud provider will take care of these firmware updates.
  • hardware updates: some of the vulnerabilities require a newer CPU. In a cloud setting, a cloud provider will provide you access to newer CPUs.
  • system software updates: some of the attacks require an update of the system software like the SGX drivers and the attestation infrastructure. If you are using a managed Kubernetes, your provider will ensure that the system software is up to date.
  • SCONE LAS updates: some of the vulnerabilities require us to update SCONE LAS (Local Attestation Service). We recommend to install SCONE LAS with the help of helm to keep LAS up-to-date.
  • Recompilation: some vulnerabilities might require recompilations of the applications. SCONE supports the recompilation with the help of its cross-compiler.

Since mitigation might need some time, we provide you also with the possibility to accept that your platform has a known vulnerability. We recommend to use this mechanism for short periods only and to update your software/firmware/hardware as quickly as possible.

Defense In-Depth

To ensure that applications are protected even if there might be some not yet known vulnerabilities in your platform or application, we suggest and support a defense-in-depth approach. Please contact us by email to talk about this option.

Firmware Updates

Most attack mitigations require an update of the firmware. A firmware update typically updates the microcode of the CPU. Note that updating the microcode of the CPU via the operating system - while being way more convenient - is not sufficient to fix vulnerabilities. Note that the platform ID will change after a security update.

Hardware Updates

Modern CPUs like the Icelake Server CPUs address most of the known vulnerabilities.