Aws Nitro Enclaves Sdk C
Monthly
Insecure handling of the caller-supplied AWS Region string in aws-nitro-enclaves-sdk-c at or before v0.4.5 lets a local application on the parent EC2 instance impersonate the AWS KMS endpoint that a Nitro Enclave connects to, enabling injection of forged KMS responses into the enclave's requests. AWS states that only enclave applications which forward an unvalidated, externally supplied region into the library are affected; there is no cross-account or cross-tenant exposure and authentic KMS responses remain separately encrypted, so confidentiality is not impacted. The vendor has released v0.4.6 with an input validation fix, but customers must also rebuild their custom enclave images; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated this_week priority rather than an emergency.
Insecure handling of the caller-supplied AWS Region string in aws-nitro-enclaves-sdk-c at or before v0.4.5 lets a local application on the parent EC2 instance impersonate the AWS KMS endpoint that a Nitro Enclave connects to, enabling injection of forged KMS responses into the enclave's requests. AWS states that only enclave applications which forward an unvalidated, externally supplied region into the library are affected; there is no cross-account or cross-tenant exposure and authentic KMS responses remain separately encrypted, so confidentiality is not impacted. The vendor has released v0.4.6 with an input validation fix, but customers must also rebuild their custom enclave images; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated this_week priority rather than an emergency.