Lucene search

[email protected]CVE-2023-38022

HistoryDec 30, 2023 - 3:15 a.m.

CVE-2023-38022

2023-12-3003:15:08

[email protected]

web.nvd.nist.gov

fortanix

enclaveos

ccm

platform

intel

sgx

cve-2023-38022

vulnerability

confidential computing

security

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.

Affected configurations

NVD

Node

fortanixconfidential_computing_managerRange<3.29intel_software_guard_extensions

CPENameOperatorVersion
fortanix:confidential_computing_managerfortanix confidential computing managerlt3.29

CPE	Name	Operator	Version
fortanix:confidential_computing_manager	fortanix confidential computing manager	lt	3.29

References

jovanbulck.github.io/files/ccs19-tale.pdf

jovanbulck.github.io/files/oakland24-pandora.pdf

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-38022

cvelist1 prion1 nvd1