GoSeverity: MediumStatus: Published

EGo: untrusted host can switch any enclave into a Marble and replace signed config files, env, and argv

An EGo app that was not meant to run under MarbleRun could still be started in Marble mode by a malicious host. With a fake MarbleRun Coordinator, the host could then supply a crafted configuration and take integrity control of the app’s embedded files, environment variables, and arguments. The attestation evidence did not show whether the app ran standalone or as a Marble, so a remote verifier could not detect this. Fixed in 1.10.1, where Marble mode is an opt-in in enclave.json and changes the enclave’s UniqueID.