CVE-2021-36219
📋 TL;DR
CVE-2021-36219 is a critical memory corruption vulnerability in SKALE sgxwallet that allows an attacker to free uninitialized stack pointers, potentially compromising the integrity of the SGX enclave. This affects users running sgxwallet versions before v1.77.0. Attackers could chain enclave calls to manipulate memory and potentially execute arbitrary code within the trusted execution environment.
💻 Affected Systems
- SKALE sgxwallet
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of SGX enclave integrity leading to arbitrary code execution, private key theft, and full control over cryptographic operations within the secure enclave.
Likely Case
Enclave memory corruption leading to denial of service, potential information leakage, or partial compromise of cryptographic operations.
If Mitigated
Limited impact if enclave isolation prevents memory corruption from affecting host system, but enclave integrity remains compromised.
🎯 Exploit Status
Exploitation requires chaining multiple enclave calls to prepare stack memory, but no authentication is needed to trigger the vulnerable ECALL.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.77.0 and later
Vendor Advisory: https://github.com/skalenetwork/sgxwallet/releases
Restart Required: Yes
Instructions:
1. Stop sgxwallet service. 2. Update to v1.77.0 or later from official SKALE repository. 3. Restart sgxwallet service. 4. Verify enclave integrity.
🔧 Temporary Workarounds
Disable vulnerable ECALL
linuxTemporarily disable ECALL 14 functionality if not required
# Requires modifying sgxwallet source code to disable ECALL 14
Network isolation
linuxRestrict network access to sgxwallet to trusted sources only
sudo iptables -A INPUT -p tcp --dport [sgxwallet_port] -s [trusted_ip] -j ACCEPT
sudo iptables -A INPUT -p tcp --dport [sgxwallet_port] -j DROP
🧯 If You Can't Patch
- Isolate sgxwallet instance from untrusted networks and external access
- Implement additional monitoring for enclave memory access patterns and abnormal behavior
🔍 How to Verify
Check if Vulnerable:
Check sgxwallet version: sgxwallet --version or examine package version. If version is earlier than v1.77.0, system is vulnerable.Check Version:
sgxwallet --versionVerify Fix Applied:
Verify sgxwallet version is v1.77.0 or later and test ECALL 14 functionality with controlled inputs.📡 Detection & Monitoring
Log Indicators:
- Multiple rapid ECALL 14 invocations
- Enclave memory allocation errors
- Unexpected enclave termination
Network Indicators:
- Unusual traffic patterns to sgxwallet port
- Multiple connection attempts from single source
SIEM Query:
source="sgxwallet.log" AND ("ECALL 14" OR "enclave termination" OR "memory error")