Researchers from Sapienza, TU Graz, AWS and CISPA disclosed ÆPIC Leak (CVE-2022-21233), an architectural bug in Sunny Cove-based Intel CPUs (10th-gen Ice Lake, 12th-gen Alder Lake and Ice Lake SP Xeons) where reading undefined ranges of the APIC MMIO page returns stale data travelling between L2 and the last-level cache.
Since the APIC page needs root, the real victim is SGX: the paper extracts AES-NI and RSA keys and even Intel’s SGX sealing and attestation keys from enclaves within seconds.
The proof of concept on GitHub brings a kernel module that dumps the APIC MMIO page to check whether your machine leaks, plus victim enclaves and an SGX-Step based single-stepper that pulls registers out of the SSA page.
Fittingly, its setup asks you to boot with nox2apic, i.e. to switch off the very mitigation.
Intel’s INTEL-SA-00657 brings microcode-20220809 and SGX SDK 2.16.101.1 (Windows) and 2.17.101.1 (Linux); the authors’ short-term advice is to disable APIC MMIO (x2APIC mode) or stop relying on SGX, which Intel conveniently already deprecated on client CPUs.
We discover ÆPIC Leak, the first architectural CPU bug that leaks stale data from the microarchitecture without using a side channel. — USENIX Security 2022 abstract