CVE-2023-22655

What it actually does

Protection mechanism failure in 3rd and 4th generation Intel Xeon processors when using SGX or TDX allows a privileged local user to escalate privileges.

Why it matters to the business

Systems using affected Intel processors for secure enclaves face risk of local privilege escalation; low EPSS and no known exploitation reduce immediate urgency but patching remains necessary for affected AlmaLinux deployments.

How an attack unfolds

A local attacker with existing privileged access leverages the SGX or TDX protection failure on vulnerable Xeon processors to obtain higher privileges; no named threat actors or public exploits are associated.

How to fix it

Upgrade sgabios and sgabios-bin packages on AlmaLinux 8 to version 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 or later; apply vendor microcode and firmware updates addressing the processor flaw where available.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases and verify that SGX or TDX operations no longer permit unauthorized privilege changes through functional testing.

Typical attack path

1. Obtain local privileged access on an affected system
2. Interact with SGX or TDX features to trigger the protection mechanism failure
3. Escalate privileges beyond the initial access level

How to detect it

Review system and audit logs for unexpected privilege changes involving SGX or TDX; correlate with process activity on affected hardware.

What your security team should do

• Apply the specified package updates to all affected AlmaLinux 8 systems
• Inventory systems using SGX or TDX on 3rd/4th generation Xeon processors
• Monitor for local privilege escalation attempts in system logs