[Paper Review] TeeRex: Discovery and Exploitation of Memory Corruption Vulnerabilities in SGX Enclaves

Tobias Cloosters, Michael Rodler+1 more|arXiv (Cornell University)|Jul 15, 2020

Security and Verification in Computing16 citations

TL;DR

TeeRex is an automated symbolic execution framework that discovers and enables exploitation of memory corruption vulnerabilities in Intel SGX enclaves by analyzing enclave binary code. It identifies critical flaws—such as arbitrary memory writes and control-flow hijacking—in real-world enclaves, including those from Intel, Baidu, WolfSSL, and major biometric fingerprint software, demonstrating widespread exploitable vulnerabilities at the host-to-enclave boundary.

ABSTRACT

Intel's Software Guard Extensions (SGX) introduced new instructions to switch the processor to enclave mode which protects it from introspection. While the enclave mode strongly protects the memory and the state of the processor, it cannot withstand memory corruption errors inside the enclave code. In this paper, we show that the attack surface of SGX enclaves provides new challenges for enclave developers as exploitable memory corruption vulnerabilities are easily introduced into enclave code. We develop TeeRex to automatically analyze enclave binary code for vulnerabilities introduced at the host-to-enclave boundary by means of symbolic execution. Our evaluation on public enclave binaries reveal that many of them suffer from memory corruption errors allowing an attacker to corrupt function pointers or perform arbitrary memory writes. As we will show, TeeRex features a specifically tailored framework for SGX enclaves that allows simple proof-of-concept exploit construction to assess the discovered vulnerabilities. Our findings reveal vulnerabilities in multiple enclaves, including enclaves developed by Intel, Baidu, and WolfSSL, as well as biometric fingerprint software deployed on popular laptop brands.

Motivation & Objective

• To investigate the prevalence and exploitability of memory corruption vulnerabilities in real-world SGX enclaves, particularly at the host-to-enclave interface.
• To address the lack of automated tools for detecting such vulnerabilities in enclave binaries, especially given the unique threat model of SGX.
• To develop a framework that not only detects vulnerabilities but also enables proof-of-concept exploit construction for validation and remediation.
• To reveal that legacy code and common programming patterns in SGX SDK usage introduce exploitable flaws despite SGX's strong isolation guarantees.

Proposed method

• TeeRex employs symbolic execution to statically analyze enclave binary code, modeling control and data flow across the host-enclave boundary.
• It incorporates SGX-specific semantics, including enclave entry/exit mechanisms, memory isolation, and privilege separation, into its symbolic execution engine.
• The framework includes custom vulnerability detectors for arbitrary memory writes, control-flow hijacking, and NULL-pointer dereferences.
• It supports state-dependent exploit construction by modeling global state dependencies and generating feasible input conditions for exploitation.
• TeeRex integrates constraint solving and taint tracking to identify input vectors that trigger memory corruption primitives.
• It generates detailed vulnerability reports and facilitates PoC exploit development by automatically synthesizing inputs that trigger exploitable conditions.

Experimental results

Research questions

• RQ1 To what extent are memory corruption vulnerabilities present in real-world SGX enclave binaries, particularly those developed with the Intel SGX SDK?
• RQ2 Can symbolic execution be effectively adapted to detect memory corruption vulnerabilities in SGX enclave binaries, given their unique execution model and isolation semantics?
• RQ3 How do common programming patterns and legacy code porting practices introduce exploitable flaws at the host-to-enclave interface?
• RQ4 Can an automated framework not only detect but also assist in constructing proof-of-concept exploits for discovered vulnerabilities?
• RQ5 What are the most prevalent vulnerability patterns in SGX enclaves, and how do they affect the security guarantees of the TEE?

Key findings

• TeeRex discovered exploitable memory corruption vulnerabilities in multiple public SGX enclaves, including those from Intel, Baidu, WolfSSL, and biometric fingerprint software by Synaptics and Goodix.
• The vulnerabilities were primarily introduced at the host-to-enclave boundary, where untrusted input is processed without proper validation, leading to arbitrary memory writes and control-flow hijacking.
• Many of the discovered flaws stemmed from retrofitted legacy code or improper use of the Intel SGX SDK, which lacks built-in input validation mechanisms.
• The framework successfully constructed proof-of-concept exploits for all identified vulnerabilities, confirming their practical exploitability and the potential for full enclave compromise.
• The root causes of the vulnerabilities revealed recurring patterns, such as unchecked function pointer manipulation and improper handling of data pointers from untrusted sources.
• The findings indicate that similar vulnerabilities likely exist in privately deployed enclaves, highlighting a critical security gap in SGX deployment practices.