Abstract:Intel's Software Guard Extensions (SGX) offers an isolated execution environment, known as an enclave, where everything outside the enclave is considered potentially malicious, including non-enclave memory region, peripherals, and the operating system.Despite its robust attack model, the code running within enclaves is still prone to common memory corruption vulnerabilities.Moreover, such an attack model may introduce new threats or amplify existing ones.For instance, any direct memory access to untrusted memory from within an enclave can lead to Time-of-Check-Time-of-Use (TOCTOU) bugs since attackers are capable of controlling the whole untrusted memory.Moreover, null-pointer dereference may have a more severe security impact since the zero page controlled by the operating system is also considered malicious.Current fuzzing solutions, such as SGXFuzz and FuzzSGX, have limitations detecting such SGX-specific vulnerabilities.In this paper, we propose EnclaveFuzz, a multi-dimension structure-aware fuzzing framework that analyzes enclave sources to extract input structures and correlations, then generates fuzz harnesses that can produce valid inputs to pass sanity checks.To conduct multi-dimensional fuzzing, EnclaveFuzz creates data for all three input dimensions of an enclave, including both parameters and return values that enter an enclave, as well as direct untrusted memory access from within an enclave.To detect more types of vulnerabilities, we design a new sanitizer to detect both SGX-specific vulnerabilities and typical memory corruption vulnerabilities.Lastly, we provide a custom SDK to accelerate the fuzzing process and execute the enclave without the need for special hardware.To verify the effectiveness of our solution, we applied our work to test 20 real-world open-source enclaves and found 162 bugs in 14 of them.

SEnFuzzer: Detecting SGX Memory Corruption via Information Feedback and Tailored Interface Analysis

EnclaveFuzz: Finding Vulnerabilities in SGX Applications

A Survey of Intel SGX and Its Applications.

MorFuzz: Fuzzing Processor Via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation.

EM-Fuzz: Augmented Firmware Fuzzing Via Memory Checking

SymGX: Detecting Cross-boundary Pointer Vulnerabilities of SGX Applications Via Static Symbolic Execution

SGXLock: Towards Efficiently Establishing Mutual Distrust Between Host Application and Enclave for SGX

Towards Memory Safe Enclave Programming with Rust-SGX

See Through Walls: Detecting Malware in SGX Enclaves with SGX-Bouncer.

SmashEx: Smashing SGX Enclaves Using Exceptions

Mind Your Enclave Pointers! Detecting Privacy Leaks for SGX Apps Via Sparse Taint Analysis

ECG: Augmenting Embedded Operating System Fuzzing via LLM-Based Corpus Generation

Interface-Based Side Channel Attack Against Intel SGX

VoltJockey: Breaking SGX by Software-Controlled Voltage-Induced Hardware Faults

ESFuzzer: An Efficient Way to Fuzz WebAssembly Interpreter

Detecting and Mitigating Cache Side Channel Threats on Intel SGX

SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices

POSTER: Rust SGX SDK: Towards Memory Safety in Intel SGX Enclave.

Designing a Provenance Analysis for SGX Enclaves

MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries

Efficiently Hardening SGX Enclaves against Memory Access Pattern Attacks via Dynamic Program Partitioning