Firmware area
Intel SGX
The CVEs of Intel Software Guard Extensions in Intel's processors, microcode and platform firmware, and the CVEs that concern both SGX and TDX.
- Also known as
- Software Guard Extensions
- Kind
- Firmware
- CVEs
- 20
- Published
- 2017–2025
SGX runs code in enclaves, memory that other software, the operating system and the hypervisor included, cannot read. Intel’s advisories list SGX on Core processors from the 6th generation and on Xeon E3, E, D and Scalable processors.
Most fixes are microcode that raises its security version number (SVN), followed by what Intel calls an SGX TCB recovery: attestation then tells a remote party whether the platform carries the fix. Several advisories add that on a system with SGX enabled the fixed microcode has to come from the platform flash, through the firmware interface table, as microcode that the operating system loads does not mitigate the issue there.
CVEs that concern both SGX and TDX are listed here, and their advisories also on the TDX page. Intel’s advisories for the SGX SDK, platform software, DCAP and the Linux driver concern software, not the processor, and are not listed. L1 Terminal Fault’s SGX variant (CVE-2018-3615), Plundervolt’s voltage settings (CVE-2019-11157) and the RAPL interface of Platypus (CVE-2020-8694 and CVE-2020-8695) are described with their vulnerabilities; their advisories, which each ended with an SGX TCB recovery, are below.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2017-5691 | Early system state check (described below) | Intel | 2017-07-26 |
| CVE-2019-0117 | Protected memory with processor graphics (described below) | Intel | 2019-11-14 |
| CVE-2019-0123 | SGX memory protection (described below) | Intel | 2019-11-14 |
| CVE-2020-24491 | Debug message with memory addresses (described below) | Intel | 2021-02-17 |
| CVE-2022-0005 | SGX data through JTAG probing (described below) | Intel | 2022-05-12 |
| CVE-2022-33196 | Memory controller default permissions (described below) | Intel | 2023-02-16 |
| CVE-2022-38090 | Stale data read from the legacy xAPIC under SGX | Intel | 2023-02-16 |
| CVE-2022-41804 | Unauthorized error injection (described below) | Intel | 2023-08-11 |
| CVE-2023-22655 | Trusted Execution Configuration Register Access | Intel | 2024-03-14 |
| CVE-2023-32666 | On-chip debug and test interface (described below) | Intel | 2024-03-14 |
| CVE-2023-43490 | Microcode keying calculation (described below) | Intel | 2024-03-14 |
| CVE-2023-43753 | SGX conditions check (described below) | Intel | 2024-09-16 |
| CVE-2024-21820 | Memory controller permissions (described below) | Intel | 2024-11-13 |
| CVE-2024-23918 | Memory controller conditions check (described below) | Intel | 2024-11-13 |
| CVE-2024-36293 | EDECCSSA access control (described below) | Intel | 2025-02-12 |
| CVE-2024-48869 | Software interfaces to hardware features (described below) | Intel | 2025-05-13 |
| CVE-2025-20053 | Xeon firmware buffer restrictions with SGX (described below) | Intel | 2025-08-12 |
| CVE-2025-24305 | Alias Checking Trusted Module (described below) | Intel | 2025-08-12 |
| CVE-2025-26403 | Memory subsystem out-of-bounds write (described below) | Intel | 2025-08-12 |
| CVE-2025-32086 | DDRIO configuration check (described below) | Intel | 2025-08-12 |
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2017-5691: Early system state check
An incorrect check let compromised system firmware weaken SGX through an incorrect early system state, on 6th and 7th generation Core and Xeon E3 v5 and v6 processors; fixed by BIOS updates. INTEL-SA-00076. Source. CVE record (2017-07-26).
CVE-2019-0117: Protected memory with processor graphics
Insufficient access control in the protected memory subsystem of SGX on 6th to 9th generation Core and Xeon E3 v5, v6, E-2100 and E-2200 processors with processor graphics; a privileged user could disclose enclave data. INTEL-SA-00219. Source. CVE record (2019-11-14).
CVE-2019-0123: SGX memory protection
Insufficient memory protection in 6th generation Core processors and later that support SGX could let a privileged user escalate privilege; fixed by BIOS updates. INTEL-SA-00220. Source. CVE record (2019-11-14).
CVE-2020-24491: Debug message with memory addresses
A debug message carrying the addresses of memory transactions could disclose enclave information on some 10th generation Core processors (Ice Lake, such as the i7-1065G7) with SGX. INTEL-SA-00455. Source. CVE record (2021-02-17).
CVE-2022-0005: SGX data through JTAG probing
Sensitive SGX data could be read by physically probing the JTAG interface of 6th to 11th generation Core, Xeon E, W and 3rd Gen Xeon Scalable processors; fixed by microcode with an SGX TCB recovery. INTEL-SA-00614. Source. CVE record (2022-05-12).
CVE-2022-33196: Memory controller default permissions
Incorrect default permissions in some memory controller configurations of 3rd Gen Xeon Scalable and Xeon D processors let a privileged user escalate privilege under SGX. INTEL-SA-00738. Source. CVE record (2023-02-16).
CVE-2022-41804: Unauthorized error injection
Unauthorized error injection in SGX or TDX on 3rd and 4th Gen Xeon Scalable and Xeon D processors let a privileged user escalate privilege; the microcode must come from platform flash. INTEL-SA-00837. Source. CVE record (2023-08-11).
CVE-2023-32666: On-chip debug and test interface
Improper access control in an on-chip debug and test interface of some 4th Gen Xeon processors let a privileged user escalate privilege under SGX or TDX. INTEL-SA-00986. Source. CVE record (2024-03-14).
CVE-2023-43490: Microcode keying calculation
An incorrect calculation in the microcode keying mechanism of some Xeon D processors with SGX could let a privileged user disclose information. INTEL-SA-01045. Source. CVE record (2024-03-14).
CVE-2023-43753: SGX conditions check
An improper conditions check in some processors with SGX (Xeon D, 3rd Gen Xeon Scalable, Xeon E) could let a privileged user disclose information. INTEL-SA-01071. Source. CVE record (2024-09-16).
CVE-2024-21820: Memory controller permissions
Incorrect default permissions in some Xeon memory controller configurations let a privileged user escalate privilege under SGX; 3rd, 4th and 5th Gen Xeon Scalable and Xeon D. INTEL-SA-01079. Source. CVE record (2024-11-13).
CVE-2024-23918: Memory controller conditions check
A flawed condition check in some Xeon memory controller configurations let a privileged user escalate privilege under SGX; 3rd, 4th and 5th Gen Xeon Scalable and Xeon D. INTEL-SA-01079. Source. CVE record (2024-11-13).
CVE-2024-36293: EDECCSSA access control
Improper access control in the EDECCSSA leaf function of ENCLU lets an authenticated user cause a denial of service, on SGX processors from 8th Gen Core and Xeon E to 4th Gen Xeon Scalable; fixed by microcode. INTEL-SA-01213. Source. CVE record (2025-02-12).
CVE-2024-48869: Software interfaces to hardware features
Improperly restricted software interfaces to hardware features let a privileged user escalate privilege under SGX or TDX on Xeon 6 processors with E-cores. INTEL-SA-01268. Source. CVE record (2025-05-13).
CVE-2025-20053: Xeon firmware buffer restrictions with SGX
Improper buffer restrictions in the firmware of some Xeon processors with SGX enabled let a privileged user escalate privilege; 4th and 5th Gen Xeon Scalable and Xeon 6. INTEL-SA-01313. Source. CVE record (2025-08-12).
CVE-2025-24305: Alias Checking Trusted Module
Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware let a privileged user escalate privilege; 4th and 5th Gen Xeon Scalable and Xeon 6 with E-cores. INTEL-SA-01313. Source. CVE record (2025-08-12).
CVE-2025-26403: Memory subsystem out-of-bounds write
An out-of-bounds write in the memory subsystem of some Xeon 6 processors let a privileged user escalate privilege under SGX or TDX. INTEL-SA-01367. Source. CVE record (2025-08-12).
CVE-2025-32086: DDRIO configuration check
An improperly implemented security check in the DDRIO configuration of some Xeon 6 processors let a privileged user escalate privilege under SGX or TDX. INTEL-SA-01367. Source. CVE record (2025-08-12).
Advisories
INTEL-SA-01313: 2025.3 IPU, Intel Xeon Processor Firmware Advisory
2025-08-12. CVE-2025-20053, CVE-2025-24305
INTEL-SA-01367: Intel Xeon 6 Processor Firmware Advisory
2025-08-12. CVE-2025-26403, CVE-2025-32086
INTEL-SA-01268: Intel Xeon 6 processor with E-cores SGX and TDX Advisory
2025-05-13. CVE-2024-48869
INTEL-SA-01213: 2025.1 IPU, Intel SGX Advisory
2025-02-11. CVE-2024-36293
INTEL-SA-01079: Intel Xeon Processor with Intel SGX Advisory
2024-11-12. CVE-2024-21820, CVE-2024-23918
INTEL-SA-01071: 2024.3 IPU, UEFI Firmware Advisory
2024-09-10. CVE-2023-43753
INTEL-SA-00960: 2024.1 IPU, Intel Xeon Processor Advisory
2024-03-12. CVE-2023-22655
INTEL-SA-00986: 4th Gen Intel Xeon Processor Advisory
2024-03-12. CVE-2023-32666
INTEL-SA-01045: 2024.1 IPU OOB, Intel Xeon D Processor Advisory
2024-03-12. CVE-2023-43490
INTEL-SA-00837: 2023.3 IPU, Intel Xeon Processor Advisory
2023-08-08. CVE-2022-41804
INTEL-SA-00738: 2023.1 IPU, Intel Xeon Processor Advisory
2023-02-14. CVE-2022-33196
INTEL-SA-00767: 2023.1 IPU, Intel Processor Advisory
2023-02-14. CVE-2022-38090
INTEL-SA-00614: 2022.1 IPU, Intel SGX Advisory
2022-05-10. CVE-2022-0005
INTEL-SA-00455: Intel SGX Platform Advisory
2021-02-09. CVE-2020-24491
INTEL-SA-00389: 2020.2 IPU, Intel RAPL Interface Advisory
2020-11-10. CVE-2020-8694, CVE-2020-8695
INTEL-SA-00289: Intel Processors Voltage Settings Modification Advisory
2019-12-10. CVE-2019-11157
INTEL-SA-00219: 2019.2 IPU, Intel SGX with Intel Processor Graphics Update Advisory
2019-11-12. CVE-2019-0117
INTEL-SA-00220: 2019.2 IPU, Intel SGX and TXT Advisory
2019-11-12. CVE-2019-0123
INTEL-SA-00161: Q3 2018 Speculative Execution Side Channel Update
2018-08-14. CVE-2018-3615
INTEL-SA-00076: SGX Update
2017-07-25. CVE-2017-5691
Sources
- INTEL-SA-00076: SGX Update
- INTEL-SA-00220: 2019.2 IPU, Intel SGX and TXT Advisory
- INTEL-SA-00738: 2023.1 IPU, Intel Xeon Processor Advisory
- INTEL-SA-00837: 2023.3 IPU, Intel Xeon Processor Advisory
- INTEL-SA-01045: 2024.1 IPU OOB, Intel Xeon D Processor Advisory
- INTEL-SA-00289: Intel Processors Voltage Settings Modification Advisory
- INTEL-SA-00389: 2020.2 IPU, Intel RAPL Interface Advisory