Intel SGX / dynamic voltage and frequency scaling interface: MULTI-TENANT ISOLATION: Undervolting the CPU through

Impact

MULTI-TENANT ISOLATION: Undervolting the CPU through the privileged voltage-scaling MSR induces faults inside SGX enclaves, which is enough to extract AES keys and to corrupt RSA-CRT signatures into key-recovering faulty signatures. The attacker is the host operator - which is precisely the party SGX is supposed to be defended against - so this collapses confidential compute on the affected generations.

Who can reach it

Privileged local access on the host (ring 0). That is the SGX threat model: the platform owner attacking a tenant's enclave, or a compromised hypervisor attacking a confidential workload.

What to do

BIOS/firmware update that locks the undervolting MSR, and a TCB recovery: enclaves must re-attest against the new SVN and any secrets sealed under the old TCB should be considered compromised. Because the lock is applied by platform firmware, this needs an OEM BIOS release and a full drain-and-reboot per node - OEM availability historically lagged Intel's advisory by months on server boards.

References