CVE-2023-38023

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an "AEPIC Leak."

Se descubrió un problema en SCONE Confidential Computing Platform anterior a 5.8.0 para Intel SGX. La falta de lógica de alineación de puntero en __scone_dispatch y otras funciones de entrada permite que un atacante local acceda a información no autorizada, también conocida como "fuga AEPIC".

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-07-11 CVE Reserved
2023-12-30 CVE Published
2023-12-30 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (7)

URL	Tag	Source
https://github.com/openenclave/openenclave/security/advisories/GHSA-v3vm-9h66-wm76	Not Applicable
https://jovanbulck.github.io/files/oakland24-pandora.pdf	Technical Description
https://sconedocs.github.io/release5.7	Release Notes
https://sconedocs.github.io/release5.8	Release Notes
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/stale-data-read-from-xapic.html	Not Applicable
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html#inpage-nav-3-2-2	Not Applicable
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html	Not Applicable

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Scontain Search vendor "Scontain"	Scone Search vendor "Scontain" for product "Scone"	< 5.8.0 Search vendor "Scontain" for product "Scone" and version " < 5.8.0"	-	Affected	in	Intel Search vendor "Intel"	Software Guard Extensions Search vendor "Intel" for product "Software Guard Extensions"	-	-	Safe