CVE-2023-52568

What it actually does

NULL pointer dereference in sgx_encl_eaug_page when the SGX EPC reclaimer sets secs.epc_page to NULL and a concurrent EAUG page fault handler uses the pointer without checking, unlike the existing ELDU path.

Why it matters to the business

Kernel panic or denial of service on systems running Intel SGX workloads; low operational risk given absence from KEV, flat low EPSS, and no known threat actor use after nearly three years.

How an attack unfolds

A local attacker running SGX enclave code triggers a page fault on a non-SECS page while the reclaimer simultaneously evicts the last SECS page; the resulting race reaches sgx_encl_eaug_page with a NULL secs.epc_page and dereferences it.

How to fix it

Upgrade the Linux kernel to a version containing commit 811ba2ef0cb6402672e64ba1419d6ef95aa3405d or later; apply the backported fix from stable trees if running a distribution kernel that includes SGX support.

How to confirm the fix worked

Confirm the running kernel contains commit 811ba2ef0cb6402672e64ba1419d6ef95aa3405d; reproduce enclave page-fault workloads under memory pressure and verify absence of the sgx_encl_eaug_page NULL dereference oops.

Typical attack path

1. Obtain local execution on a Linux system with SGX enabled
2. Create or load an enclave that leaves only one resident non-SECS page
3. Force the reclaimer (ksgxd) to evict the SECS page
4. Trigger a #PF on a non-resident enclave page that requires EAUG handling
5. Cause kernel NULL pointer dereference and crash

How to detect it

Search kernel logs and core dumps for NULL pointer dereference oops containing sgx_encl_eaug_page, sgx_vma_fault, and the exact RIP offset shown in the original trace; correlate with SGX enclave process activity and ksgxd reclaim threads.

• sgx_encl_eaug_page+0xc7/0x210
• BUG: kernel NULL pointer dereference, address: 0000000000000000
• RIP: 0010:sgx_encl_eaug_page
• sgx_vma_fault+0x119/0x230

What your security team should do

• Patch kernels on all SGX-capable hosts within normal maintenance windows
• Disable SGX in BIOS/UEFI on systems that do not require it to reduce attack surface
• Add kernel oops signatures for sgx_encl_eaug_page to SIEM alerting rules
• Review enclave-using applications for graceful handling of unexpected enclave termination