CVE-2020-8695

A vulnerability was found in Intel's implementation of RAPL (Running Average Power Limit). An attacker with a local account could query the power management functionality to intelligently infer SGX enclave computation values by measuring power usage in the RAPL subsystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a firmware update and reboot can be applied, the attack vector can be reduced by limiting read access to the sysfs attributes that export this functionality to userspace.

The command:

sudo chmod 400 /sys/class/powercap/intel_rapl/*/energy_uj

Will do this for the current boot, it will need to be scripted to run at each boot to remain persistent across reboots.