The Guard's Dilemma: Efficient Code-Reuse Attacks Against Intel SGX

on YouTube ↗23m

" summary

Demonstrates a practical code‑reuse exploit against Intel SGX that needs no kernel privileges, causes no enclave crashes, and defeats SGX‑Shield by abusing nonrandomized SDK runtime code. It builds two primitives, Allred primitive (returns into a fake OCALL frame) and continue primitive (manufactures exception context), then combines them into an Allred+continue loop to chain full function calls, read enclave keys and exfiltrate them. Provides a working exploit on SDK enclaves and recommends hardening the SDK, per‑structure secrets, and finer‑grained CFI.

AI-written summary · about

" chapters (16)

1. 0:00Intro
2. 0:22Intel SGX (software Guard extensions)
3. 1:48SGX provides strong isolation
4. 2:41Control-Flow Attacks
5. 4:02Related work
6. 5:23The SGX SDK
7. 6:54The Guard's Dilemma
8. 7:26Motivation
9. 8:00The Basic Idea
10. 9:03The CONT Primitive
11. 13:14Attack Overview
12. 14:16Example Attack
13. 15:57Attacking SGX-Shield
14. 17:02SGX-Shield Exploit
15. 17:54Mitigations
16. 19:23Conclusion

" related talks

• 33mHacking in Darkness: Return-oriented Programming against Secure EnclavesYeongjin Jang, Taesoo Kim, Jaehyuk Lee, Jinsoo Jang, Nohyun Kwak, Yeseul Choi, Changho Choi, Marcus Peinado, Brent Byunghoon Kang · 26th USENIX Security Symposium (USENIX Security '17)
• 54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal BitcoinsMichael Schwarz, Moritz Lipp · Black Hat Asia 2018
• 25mTelling Your Secrets without Page Faults...Raoul Strackx, Frank Piessens, Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza · 26th USENIX Security Symposium (USENIX Security '17)
• 35mBringing Intel SGX to the Rust EcosystemYu Ding · RustFest Paris 2018
• 38mOne Ring -3 To Secure Them All: Computing with Hardware EnclavesAaron Bedra · Craft Conference 2021
• 32mSecure Container with SGX: Protecting Secret in Cloud EnvironmentIsaku Yamahata, Xiaoning Li · KubeCon + CloudNativeCon China 2019
• 48mSGX Secure Enclaves in Practice: Security and Crypto ReviewJean-Philippe Aumasson, Luis Merino · Black Hat USA 2016
• 47mKeynote: Code-Reuse Attacks and BeyondProf. Dr. Thorsten Holz · RuhrSec 2016