CVE-2022-46487
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
30/12/2023
Last modified:
17/04/2025
Description
Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:scontain:scone:*:*:*:*:*:*:*:* | 5.8.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://jovanbulck.github.io/files/acsac20-fpu.pdf
- https://jovanbulck.github.io/files/oakland24-pandora.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2020-0561#vulnCurrentDescriptionTitle
- https://nvd.nist.gov/vuln/detail/CVE-2020-15107
- https://sconedocs.github.io/release5.7/
- https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html#inpage-nav-3-3
- https://jovanbulck.github.io/files/acsac20-fpu.pdf
- https://jovanbulck.github.io/files/oakland24-pandora.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2020-0561#vulnCurrentDescriptionTitle
- https://nvd.nist.gov/vuln/detail/CVE-2020-15107
- https://sconedocs.github.io/release5.7/
- https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html#inpage-nav-3-3