CVE-2020-15107 - CVE House
Back to Database
Status published Medium CVE-2020-15107

x87 FPU operations in enclaves are vulnerable to ABI poisoning in openenclave

Vulnerability Description

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating the Linux System V Application Binary Interface (ABI) for such operations, a host app can compromise the execution integrity of some x87 FPU operations in an enclave. Depending on the FPU control configuration of the enclave app and whether the operations are used in secret-dependent execution paths, this vulnerability may also be used to mount a side-channel attack on the enclave. This has been fixed in 0.10.0 and the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15107

Credits & Attribution

No credits recorded in the NVD database.

References

More from openenclave

View All →
CVE-2023-37479
Improper sanitization of MXCSR and RFLAGS in OpenEnclave
Medium 5.3
CVE-2020-15224
Socket syscalls can leak enclave memory contents in Open Enclave
Medium 6.8

Affected Vendor

openenclave

View all reports →

Affected Software

openenclave
Vulnerable Versions:
< 0.10.0

Timeline

Official Publish: July 15th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.