An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information stored in the Enclave. To exploit this vulnerability, an attacker would have to successfully compromise the host application running the enclave. The attacker can then pivot to the enclave and exploit this vulnerability without user interaction. The security update addresses the vulnerability by modifying how Open Enclave SDK handle objects in memory.

David Oswald (The University of Birmingham, UK), Jo van Bulck (imec-DistriNet, KU Leuven), Frank Piessens (imec-DistriNet, KU Leuven), Abdulla Aldoseri (The University of Birmingham, UK), Eduard Marin (The University of Birmingham, UK), Flavio Garcia (The University of Birmingham, UK), Mark Ryan (The University of Birmingham, UK)