CVE-2025-35987 Overview
CVE-2025-35987 affects Intel Software Guard Extensions (SGX) Data Center Attestation Primitives (DCAP) operating within Ring 0 kernel context. The flaw stems from the omission of security-relevant information [CWE-223], which can lead to denial of service conditions. An authorized adversary with privileged access can potentially alter data through a high-complexity local attack requiring special internal knowledge. The vulnerability affects the integrity and availability of the host system and produces subsequent high-integrity impact on downstream systems. Intel disclosed the issue in security advisory SA-01421.
Critical Impact
A privileged local attacker can trigger denial of service and low-level data alteration within kernel-mode SGX DCAP components, with subsequent high integrity impact on dependent systems.
Affected Products
- Intel Software Guard Extensions (SGX) Data Center Attestation Primitives (DCAP)
- Ring 0 kernel-mode SGX DCAP components
- Refer to Intel Security Advisory SA-01421 for the definitive affected version list
Discovery Timeline
- 2026-08-11 - CVE-2025-35987 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2025-35987
Vulnerability Analysis
The vulnerability resides in Intel SGX DCAP components that execute in Ring 0 kernel context. DCAP provides the attestation infrastructure that enables remote verification of SGX enclaves in data center deployments. Kernel-mode components handle sensitive attestation operations including quote generation, provisioning certification, and platform certification key handling.
The defect is classified under [CWE-223] Omission of Security-Relevant Information. Security decisions or audit trails omit data that would otherwise be necessary to detect or prevent misuse. In this context, missing security-relevant information within the DCAP kernel path can be leveraged by a privileged local adversary to disrupt service and manipulate data flows within the attestation subsystem.
Root Cause
The root cause is incomplete emission or handling of security-relevant state within SGX DCAP kernel routines. When required security context is omitted, downstream checks cannot fully validate operations. This gap permits data alteration and enables conditions that terminate or degrade DCAP-dependent services.
Attack Vector
Exploitation requires local access with high privileges and depends on specific attack requirements, including internal knowledge of the DCAP implementation. No user interaction is required. The attack complexity is high, and the attacker must already hold privileged rights on the target host. Successful exploitation impacts host integrity and availability at a low level, but the subsequent integrity impact on systems that consume DCAP attestation results is high.
No verified public exploit code is available for CVE-2025-35987. Consult the Intel Security Advisory SA-01421 for authoritative technical details.
Detection Methods for CVE-2025-35987
Indicators of Compromise
- Unexpected termination or restart of SGX DCAP services and quoting enclave processes on affected hosts.
- Anomalous attestation failures or malformed quote responses returned to relying parties.
- Kernel log entries referencing SGX DCAP components alongside privileged process activity from non-administrative workloads.
Detection Strategies
- Correlate privileged process execution with kernel-mode SGX DCAP activity to surface unusual interaction patterns.
- Baseline normal DCAP attestation response rates and alert on statistically significant deviations that suggest service disruption.
- Monitor for privilege escalation events on hosts that provide SGX attestation services, since exploitation requires prior privileged access.
Monitoring Recommendations
- Ingest kernel and DCAP service logs into a centralized data lake for longitudinal analysis and correlation.
- Track integrity of attestation outputs by comparing quote and endorsement chains against known-good baselines.
- Alert on repeated attestation validation failures from downstream consumers, which can indicate data alteration upstream.
How to Mitigate CVE-2025-35987
Immediate Actions Required
- Apply the updates referenced in Intel Security Advisory SA-01421 to all systems running SGX DCAP components.
- Inventory all hosts that expose SGX DCAP services and prioritize patching for those participating in production attestation workflows.
- Restrict privileged local access on affected hosts, since exploitation requires high privileges on the target system.
Patch Information
Intel has published guidance in security advisory SA-01421. Administrators should install the vendor-supplied DCAP updates for their platform and validate that kernel-mode components are running fixed versions. Refer directly to Intel Security Advisory SA-01421 for the authoritative version matrix and remediation steps.
Workarounds
- Limit administrative access to SGX-enabled hosts and enforce least-privilege for accounts that can load kernel modules or interact with DCAP services.
- Isolate attestation infrastructure on dedicated hosts with strict access controls to reduce local attack surface.
- Increase monitoring of privileged sessions on affected systems until the vendor patch is deployed and verified.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
