SoK: SGX.Fail: How Stuff Gets eXposed
Stephan van Schaik, Alex Seto, Thomas Yurek, Adam Batori, Bader AlBassam, Daniel Genkin
IEEE Symposium on Security and Privacy 2024 · Day 3 · Continental Ballroom 5
This talk, "SoK: SGX.Fail: How Stuff Gets eXposed," delivered by Stephan van Schaik, provides a comprehensive Systemization of Knowledge (SoK) regarding vulnerabilities in Intel Software Guard Extensions (Intel SGX). It meticulously details the nature of these attacks, the types of information they can leak, and the available countermeasures. The core premise revolves around the critical, yet often overlooked, role of timely BIOS updates in maintaining the security posture of SGX environments and the severe consequences when these updates are neglected.
AI review
This SoK cuts through the TEE hype, meticulously dissecting SGX's systemic update failures. It exposes the 'vendor dilemma' with damning empirical evidence and real-world compromises, pushing for seamless OS-level updates—a critical architectural shift. This isn't just theory; it's a wake-up call for anyone relying on SGX.