Intel's Software Guard Extensions (SGX) introduced new instructions to switch the processor to enclave mode which protects it from introspection. While the enclave mode strongly protects the memory and the state of the processor, it cannot withstand memory corruption errors inside the enclave code. Our research shows that the attack surface of SGX enclaves provides new challenges for enclave developers as exploitable memory corruption vulnerabilities are easily introduced into enclave code.

We present SGXFuzz, a coverage-guided fuzzer that introduces a novel binary input structure synthesis method to expose enclave vulnerabilities even without source-code access. To obtain code coverage feedback from enclaves, we show how to extract enclave code from distribution formats. We also present an enclave runner that allows execution of the extracted enclave code as a user-space application at native speed, while emulating all relevant environment interactions of the enclave. We use this setup to fuzz enclaves using a state-of-the-art snapshot fuzzing engine that deploys our novel structure synthesis stage. This stage synthesizes multi-layer pointer structures and size fields incrementally on-the-fly based on fault signals. Furthermore, it matches the expected input format of the enclave without any prior knowledge. We evaluate our approach on 30 open- and closed-source enclaves and found a total of 79 new bugs and vulnerabilities.

We developed TeeRex to automatically analyze enclave binary code for vulnerabilities introduced at the host-to-enclave boundary by means of symbolic execution. Our evaluation on public enclave binaries reveal that many of them suffer from memory corruption errors allowing an attacker to corrupt function pointers or perform arbitrary memory writes. TeeRex features a specifically tailored framework for SGX enclaves that allows simple proof-of-concept exploit construction to assess the discovered vulnerabilities. In the course of our research we revealed vulnerabilities in multiple enclaves, including enclaves developed by Intel, Baidu, and WolfSSL, as well as biometric fingerprint software deployed on popular laptop brands.

Our paper on TeeRex was published at the 29th USENIX Security Symposium 2020 and was awarded with the German IT-Security Prize 2020.

For more information on this research project contact Tobias Cloosters.

In the course of our research on analyzing the current state of SGX enclaves we encountered several vulnerable example enclaves, which are part of various SGX projects. For those enclaves, we worked with the affected vendors to fix the vulnerabilities in the enclave software. To foster open science and to encourage SGX developers learning about vulnerabilities in SGX software, we published a list of the affected enclaves along with the vulnerable and fixed versions of the the enclave code and our proof-of-concept (PoC) exploits. 

https://github.com/uni-due-syssec/teerex-exploits

We discovered several vulnerabilities in the SGX components of fingerprint drivers developed by Synaptics and Goodix. The affected fingerprint drivers are utilized in diverse products, e.g., Lenovo, HP and Dell laptops.

The fixed versions of the fingerprint drivers are available via Windows Update and from the vendors. The following CVE numbers and advisories can be used to identify vulnerable and patched versions:

• CVE-2019-18619
  • Synaptics' Advisory: https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf
  • Lenovo's Advisory: https://support.lenovo.com/us/en/product_security/LEN-31372
  • HP's Advisory: https://support.hp.com/hk-en/document/c06696568
• CVE-2020-11667
  • Dell's Advisory: https://www.dell.com/support/article/SLN321807