IntraFuzz: Coverage-Guided Intra-Enclave Fuzzing for Intel SGX Applications

Intel SGX is susceptible to intra-enclave software vulnerabilities. Existing automated bug-finding methods primarily focus on fuzzing enclave boundaries for SGX applications in simulated, rather than actual hardware-protected enclaves. This limits the ability to identify potential security violations originating from within SGX application code. This paper presents IntraFuzz, the first system that enables efficient fuzzing of SGX applications inside actual hardware enclaves. We evaluated IntraFUZZ with 21 real-world SGX applications, running on Intel Xeon scalable processors with up to 256 GB of enclave page cache. IntraFuzz successfully detected all vulnerabilities in SGX application code previously identified by the state-of-the-art tool EnclaveFuzz, as well as 6 previously undiscovered vulnerabilities. These results highlight the importance of hardware-based fuzzing in securing SGX applications.