Permissions, Privileges, and Access Controls in Intel SGX SDK for Windows and Intel SGX SDK for Linux - CVE-2021-0186
Published: October 21, 2021
Vulnerability identifier: #VU57596
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-0186
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local administrator to escalate privileges on the system.
The vulnerability exists due to improper input validation in the Intel SGX SDK applications compiled for SGX2 enabled processors, which leads to security restrictions bypass and privilege escalation.
This vulnerability affects the following Intel Processors supporting SGX2:
- Ice Lake Xeon-SP (HCC, XCC) - 3rd Gen Intel® Xeon® Scalable processor famil
- Ice Lake - 10th Generation Intel® Core™ Processor Famil
- Gemini Lake - Intel® Pentium® Processor Silver Series, Intel® Celeron® Processor J Series, Intel® Celeron® Processor N Serie
Affected software
Intel SGX SDK for Windows
Intel SGX SDK for Linux
Intel SGX SDK for Linux
How to mitigate CVE-2021-0186
Install updates from vendor's website.
Intel SGX SDK for Windows - update to 2.13
Intel SGX SDK for Linux - update to 2.14
Intel SGX SDK for Linux - update to 2.14