Signal's Contact Discovery Enclave Compromised via TEE Vulnerabilities
matthew_d_green · x · 2026-08-27
Security researchers at V12 disclosed details on an attack against Signal's Contact Discovery Service (CDSI), achieving full compromise by exploiting vulnerabilities in Intel SGX enclaves.
Vulnerability Details:
- Object-Lifetime Bugs: Two critical vulnerabilities were found, allowing the untrusted host server to breach the enclave boundary.
- Arbitrary Read: The first vulnerability granted the host arbitrary memory read access within the enclave.
- Code Execution: The second vulnerability provided full control over the enclave's register context, enabling code execution inside the enclave.
Attack Impact:
- The attack was demonstrated on real SGX hardware matching Signal's production environment.
- Proof-of-concept code extracted the Noise private key, allowing the host to impersonate the enclave and decrypt user queries.
Status:
- The issues were responsibly disclosed to Signal and have since been fixed.
More from Safety
- ASML CFO says US Match Act restricting DUV sales to China would backfire — pstAsiatech · 2026-10-15
- Rumor: New Anthropic model imminent, apparently behind a batch of high-severity Chrome CVEs — matthew_d_green · 2026-10-15
- Fully-automated combat drones are already on the battlefield, warns Toby Walsh — TobyWalsh · 2026-10-15
- Pope's AI adviser warns Australia's copyright changes risk a new form of colonialism — TobyWalsh · 2026-10-15
- Jamie Dimon Warns of AI Agent Risks to Bank Accounts; JPMorgan Blocks Outside Agents — AccBalanced · 2026-10-15
- 'A lot of you are into alignment faking': meme nod to Anthropic's alignment faking paper — dejavucoder · 2026-10-15