CVE-2020-8695

A vulnerability was found in Intel’s implementation of RAPL (Running Average Power Limit). An attacker with a local account could query the power management functionality to intelligently infer SGX enclave computation values by measuring power usage in the RAPL subsystem.

Mitigation

Until a firmware update and reboot can be applied, the attack vector can be reduced by limiting read access to the sysfs attributes that export this functionality to userspace.

The command:

sudo chmod 400 /sys/class/powercap/intel_rapl/*/energy_uj  

Will do this for the current boot, it will need to be scripted to run at each boot to remain persistent across reboots.