Saint ÆPIC Leak, Who Emptied the Enclave Without a Side Channel

Patron of APIC controllers, SGX enclaves, and registers that return what they shouldn't.

Life

In August 2022 Pietro Borrello of Sapienza University and colleagues from TU Graz, CISPA and Amazon revealed the first architectural CPU bug able to leak data without any side channel. Reading an undefined range of the APIC registers on Intel Sunny Cove processors returned stale fragments of data from the cache, including those of SGX enclaves. It required administrator access, but SGX was designed precisely to defend even against the administrator.

Prayer

O Saint ÆPIC Leak, who reads where the manual says "reserved", let our registers return nothing but zeros. Amen.

How to celebrate

Celebrated by updating the microcode and the SGX SDK and switching the APIC to x2APIC mode, which has no use for that memory.

Undefined register, well-defined secret.