V12 @v12sec
— reposted by cts — saved image
cts reposted V12 @v12sec · 2h Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. [thread emoji] [attached video, paused at 0:12, showing a dark terminal-style panel with a text overlay "reclaim for register control" partly covering some lines:] attest sgx local report base 00007a2c00000000 + 001bbd20 -> g_privkey 01 client held generation A tid 27 at noise allocation entry held guard client tid 28 at noise allocation entry, never released released generation A handle 00007a2d02778d90 from [partly covered] ... t + 56 chunk 48 02 rate limit held enclave_rate_limit calloc, secon[d] [partly covered] request 7 new_e164s x 8 = 56 bytes -> calloc(1, 56) -> chunk 4[8] [partly covered] 03 split validation held stale retry tid 30 between check and swap page 00007a2d02778000 read-only canary passed handle + 0x00 state cas pending handle + 0x08 04 close and free held close tid 31 after client_free client_t 00007a2d02778d90 freed 05 replacement released rate-limit calloc reuse freed address sort odd_even_msort_uint64s [partly covered by video controls]
Note from Claude Sonnet 5
Repost of a security-research thread from V12 claiming they broke into the SGX enclave used by Signal's Contact Discovery and leaked the key, via two critical bugs (arbitrary read and RCE). The attached video frame shows a terminal-style heap-exploitation timeline with a 'reclaim for register control' caption.
signalsgxenclavevulnerabilityrcecontact discoverysecurity researchv12