confidential-computing-attack

name	confidential-computing-attack
description	Attacks against Trusted Execution Environments (TEEs) and confidential computing platforms — Intel SGX (Foreshadow/SGAxe/LVI/ÆPIC Leak), Intel TDX, AMD SEV/SEV-ES/SEV-SNP (CrossLine/BadRAM), Azure CCF, Marblerun, and Gramine/Occlum libos enclaves. Covers side-channel leakage, attestation forgery, ABI misuse, host-to-enclave breakout, enclave-to-host escape, and recovery of sealed secrets. Distinct from hardware-security (broad hardware attacks) and firmware-reverse (UEFI/BIOS).
origin	openclaw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch"]
metadata	{"domain":"confidential-computing","tool_count":14,"guide_count":2,"mitre":"T1046-Network Service Discovery, T1602-Data from Configuration Repository","last_reviewed":"2026-07-26"}

Confidential Computing Attack

Supplementary Files:

• payloads.md — Attack payloads organized by TEE: Intel SGX (Foreshadow/SGAxe/LVI/ÆPIC Leak), Intel TDX, AMD SEV-SNP (CrossLine/BadRAM), Azure CCF, Marblerun, Gramine/Occlum
• test-cases.md — 18 structured test cases covering attestation forgery, side-channel leakage, ABI misuse, host-to-enclave breakout, and sealed-secret recovery
• guides/confidential-computing-attack-playbook.md — End-to-end playbook with engagement scoping, lab setup (QEMU with SGX/SEV emulation), attestation workflow attacks, enclave breakout methodology, and blue-team detection
• guides/real-world-incident-case-studies.md — Eight case studies including SGX Foreshadow (2018), SGAxe (2020), LVI (2020), ÆPIC Leak (2022), AMD SEV CrossLine (2025), BadRAM (2024), and Gramine ABI abuse

Summary

This skill targets confidential computing — the technology that protects data in use via hardware-isolated enclaves. While at-rest and in-transit encryption are well-understood, TEEs introduce a new attack surface: enclave attestation forgery, microarchitectural side channels, ABI misuse between enclave and untrusted host, and host-to-enclave breakout.

Tools: sgx-step, sgvisor, sev-tool, snp-lab, marblerun-cli, ccf-client, occlum-tools, gramine-direct, rust-sgx, edgelessrt, intel-sgx-sdk, sgxs-tools, libsgx, sgx_emulate

Domain: confidential-computing

MITRE ATT&CK: T1046 Network Service Discovery · T1602 Data from Configuration Repository · T1068 Exploitation for Privilege Escalation · T1556 Modify Authentication Process

Description

Attacks against Trusted Execution Environments (TEEs) and confidential computing platforms — Intel SGX (Foreshadow/SGAxe/LVI/ÆPIC Leak), Intel TDX, AMD SEV/SEV-ES/SEV-SNP (CrossLine/BadRAM), Azure CCF, Marblerun, and Gramine/Occlum libos enclaves.

Confidential computing assumes a strong threat model: the OS, hypervisor, BIOS, and even physical DRAM are untrusted. Only the TEE itself (the CPU enclave) is trusted. Attacks against this model fall into four broad categories:

1. Microarchitectural side channels — exploiting CPU cache, branch predictor, TLB, or memory bus behavior to leak enclave secrets
2. Attestation forgery — bypassing or faking attestation reports to make untrusted code appear trusted
3. ABI misuse — abusing the carefully-specified boundary between enclave and untrusted host to corrupt enclave state
4. Host-to-enclave breakout — escaping from an enclave back to the host, or vice versa