CVE-2023-52568

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race

The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an

enclave and set secs.epc_page to NULL. The SECS page is used for EAUG

and ELDU in the SGX page fault handler. However, the NULL check for

secs.epc_page is only done for ELDU, not EAUG before being used.

Fix this by doing the same NULL check and reloading of the SECS page as

needed for both EAUG and ELDU.

The SECS page holds global enclave metadata. It can only be reclaimed

when there are no other enclave pages remaining. At that point,

virtually nothing can be done with the enclave until the SECS page is

paged back in.

An enclave can not run nor generate page faults without a resident SECS

page. But it is still possible for a #PF for a non-SECS page to race

with paging out the SECS page: when the last resident non-SECS page A

triggers a #PF in a non-resident page B, and then page A and the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References