Intel processors (L1D eviction sampling) / SGX attestation keys: MULTI-TENANT ISOLATION: Stale data can be sampled out

Impact

MULTI-TENANT ISOLATION: Stale data can be sampled out of L1D fill buffers during cache-line eviction, leaking across privilege and enclave boundaries. The consequence operators care about is the SGAxe result built on it: recovery of the machine's SGX attestation keys, which lets an attacker produce quotes that pass Intel's attestation service for a machine whose enclaves are entirely under their control. Once that happens, remote attestation stops proving anything about that platform.

Who can reach it

Local code on the same core as the victim; with SMT enabled, a sibling-thread co-tenant.

What to do

Microcode update, which is late-loadable at boot without an OEM BIOS release, plus a TCB recovery and re-attestation. Also disable SMT or enforce core scheduling on nodes serving untrusted tenants. Any attestation key material provisioned before the microcode update must be treated as compromised - the fix does not revoke it for you.

References