Intel Preparing Linux Support To Handle Live Microcode Updates Affecting SGX

[phoronix]

Phoronix: Intel Preparing Linux Support To Handle Live Microcode Updates Affecting SGX

While there have already been a number of vulnerabilities exhibited for Intel's Software Guard Extensions (SGX) from Prime+Probe to Plundervolt, Spectre-like attacks, SGAxe, and others, it looks like they expect more still to come in the future. Intel engineers are working on the ability for SGX to gracefully handle live CPU microcode updates without a reboot, which these days is increasingly driven for security mitigations and system administrators wanting to apply said updates right away while foregoing downtime...

https://www.phoronix.com/scan.php?page=news_item&px=Intel-SGX-Live-Microcode-Update

[Developer12]

I seem to recall intel deprecating SGX in some of their recent chips. I had thought they might have finally realized just how terrible and unworkable an idea it is to run your code on your adversary's hardware, but it seems the Hollywood money is too strong.

[baka0815]

How is it possible to update the microcode for the enclave if it should be non-changeable from the software side? Do the microcode files need to be signed by intel and are then uploaded to the SGX which then checks the signature and runs the update?

[numacross]

I seem to recall intel deprecating SGX in some of their recent chips. I had thought they might have finally realized just how terrible and unworkable an idea it is to run your code on your adversary's hardware, but it seems the Hollywood money is too strong.

They deprecated it from mainstream platforms (AFAIK rendering UHD Blurays essentially legally unwatchable on new CPUs in PCs). It's still alive in Xeons.

How is it possible to update the microcode for the enclave if it should be non-changeable from the software side? Do the microcode files need to be signed by intel and are then uploaded to the SGX which then checks the signature and runs the update?

Microcode updates are encrypted and signed (since ~Nehalem) by Intel so are still within the chain of trust. You can't just run your own (as cool as that would be).