SGXPecial: Specializing SGX Interfaces against Code Reuse Attacks

Abstract

Intel SGX is a hardware-based trusted execution technology that partitions an application into trusted and untrusted parts. The trusted part, known as an enclave, executes within an encrypted memory environment, preventing the host application and the OS from being able to access its memory. The enclave, however, has the ability to access the host's memory. When considering malicious code running in an enclave, the strong memory isolation and encryption properties offered may aid the stealthiness of malware, since malware detection tools cannot inspect the enclave. The enclave and the host communicate over bi-directional interfaces that the Intel SGX SDK generates. In this work, we present SGXPecial, a best-effort interface specialization tool that statically analyzes both the host and the enclave to generate interfaces tailored only to their needs. SGXPecial is implemented as an extension to the Edger8r tool of the SGX SDK, and performs API specialization at build time. In particular, SGXPecial performs function, argument, and type-based specialization to restrict the valid control flows across the host-to-enclave boundary. We evaluate SGXPecial's security impact by testing it on SGX SDK sample applications and four open-source SGX applications. SGXPecial effectively prevents five proof-of-concept code reuse attacks in all tested applications.