Security research firm V12 has disclosed two vulnerabilities in Signal's Contact Discovery Service that allowed the untrusted server host to break out of the Intel SGX enclave that protects users' address books. Researcher Nihal demonstrated both flaws on the same class of hardware Signal runs in production, extracting the enclave's private key and defeating the confidentiality guarantee that private contact discovery is built on. Neither issue has been assigned a CVE ID or a CVSS score at the time of writing. Both are object-lifetime bugs in the enclave's C code: the first is a use-after-free that yields an arbitrary read of enclave memory, and the second is a time-of-check-to-time-of-use (TOCTOU) race that hands the host full control of the enclave's register context, allowing code execution inside the trusted boundary. V12 reported both privately, and Signal has fixed them. What Is Signal's Contact Discovery Service? Contact Discovery Service Icelake (CDSI) is …
