CVE-2023-43490

What it actually does

Incorrect calculation in the microcode keying mechanism for affected Intel Xeon D processors with SGX allows a privileged local user to disclose sensitive information, potentially from SGX enclaves.

Why it matters to the business

Organizations using affected Intel Xeon D processors risk unauthorized exposure of confidential data processed in SGX environments, increasing compliance and data breach costs; low exploit likelihood reduces urgency but hardware replacement or microcode updates may still be needed for high-security workloads.

How an attack unfolds

An attacker with local privileged access crafts inputs that trigger the flawed microcode keying calculation on an affected Intel Xeon D processor running SGX, resulting in leakage of enclave-protected data without requiring remote access or user interaction.

How to fix it

Apply the latest Intel microcode updates addressing the keying calculation flaw on affected Xeon D processors; where microcode fixes are unavailable, isolate or replace impacted hardware. Note that the listed python3-gevent package fix (1.2.2-4.el8) appears unrelated to this hardware issue.

How to confirm the fix worked

Verify microcode version against Intel advisory lists for the specific Xeon D model; confirm SGX functionality remains intact post-update and test for absence of the keying calculation error using Intel-provided validation tools or SGX attestation checks.

Typical attack path

1. Obtain local privileged access on a target system with an affected Intel Xeon D processor and SGX enabled
2. Execute code that interacts with the SGX microcode keying mechanism using specially crafted inputs
3. Trigger the incorrect calculation to extract sensitive information from protected memory regions

How to detect it

Review system logs for unusual SGX enclave access patterns or microcode-related errors on affected hardware; look for privileged local processes attempting repeated interactions with SGX keying functions.

What your security team should do

• Inventory systems with affected Intel Xeon D processors and prioritize microcode patching based on SGX usage
• Monitor Intel microcode release channels for updates and schedule hardware refreshes for unpatchable systems
• Restrict local privileged access on SGX-enabled hosts until remediation is complete