Observable discrepancy in Intel products - CVE-2021-0001

Vulnerability identifier: #VU54157

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-0001

CWE-ID: CWE-203

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to observable timing discrepancy. A local user can gain unauthorized access to sensitive information on the system.

Intel SGX SDK for Windows
Intel SGX SDK for Linux
Intel Software Guard Extensions (SGX) Datacenter Attestation Primitives (DCAP)
Intel SGX PSW for Windows
Intel SGX PSW for Linux
Intel Integrated Performance Primitives

Install updates from vendor's website.

Intel SGX SDK for Windows - update to 2.12.103
Intel SGX SDK for Linux - update to 2.13.103
Intel Software Guard Extensions (SGX) Datacenter Attestation Primitives (DCAP) - update to 1.10.103
Intel SGX PSW for Windows - update to 2.12.103
Intel SGX PSW for Linux - update to 2.13.103
Intel Integrated Performance Primitives - update to 2020 update 1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00477.html

• Information disclosure in Intel IPP and SGX Software