CVE-2025-35987 in Software Guard Extensions Data Center Attestation Primitives
Summary
by MITRE • 08/11/2026
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical security flaw within Intel Software Guard Extensions Data Center Attestation Primitives that operates at the kernel level within ring 0 privileges. This issue stems from the omission of security-relevant information during the attestation process, which fundamentally undermines the trust model that these cryptographic primitives are designed to establish. The vulnerability specifically affects the integrity and availability aspects of systems utilizing Intel SGX technology in data center environments where attestation is critical for establishing secure communication channels between enclaves and external parties.
The technical flaw manifests as a failure in the kernel-level implementation of the Intel SGX Data Center Attestation Primitives to properly handle security-relevant information during the attestation process. This omission creates a potential attack vector where an authorized adversary with privileged user access can exploit the system's reliance on incomplete security data. The vulnerability requires a combination of factors including elevated privileges, specialized internal knowledge, and specific attack conditions that are typically difficult to achieve but not impossible. The attack complexity is classified as high, suggesting that while it requires significant expertise, the attack surface is not entirely closed to determined threat actors who understand the internal workings of Intel SGX implementations.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to include potential data alteration capabilities when properly orchestrated by an adversary. While the immediate confidentiality impact is minimal according to the assessment, the long-term implications for system integrity are significant since compromised attestation processes can lead to unauthorized modifications of sensitive data within enclaves. The availability impact is rated as low initially, but this rating may be misleading given that successful exploitation could potentially lead to more severe availability issues when the compromised attestation process causes cascading failures in secure communication channels.
From a cybersecurity perspective, this vulnerability aligns with CWE-200 (Information Exposure) and CWE-310 (Cryptographic Issues) categories, representing both information leakage and cryptographic weakness within kernel-level security primitives. The ATT&CK framework would categorize this under T1552 (Unsecured Credentials) and potentially T1070 (Indicator Removal on Host) as adversaries could manipulate the attestation process to hide malicious activities while maintaining system access. The local access requirement for exploitation suggests this vulnerability is more likely to be encountered in targeted attacks against systems where adversaries have already achieved privileged access, making it particularly dangerous in environments with compromised internal security.
Mitigation strategies should focus on implementing comprehensive monitoring of kernel-level attestation processes and establishing robust audit trails that can detect anomalous behavior in cryptographic operations. System administrators should consider implementing additional verification layers beyond the standard Intel SGX attestation mechanisms, including custom integrity checks and periodic validation of enclave states. The vulnerability demonstrates the critical importance of complete information handling within security-sensitive kernel components, as incomplete data exposure during cryptographic operations can fundamentally compromise the security model that these technologies are designed to provide. Regular updates to Intel SGX drivers and kernel components should be prioritized along with comprehensive security assessments that specifically target the attestation process implementation.