AWS Nitro Enclaves SDK 0.4.6 Fixes Two Security Issues
Tech GuruQuick Answer
AWS Nitro Enclaves SDK for C 0.4.6 fixes a kmstool-enclave use-after-free and KMS server-name validation flaw. Inventory embedded SDK copies and enclave images, upgrade, rebuild and redeploy them, validate attestation and KMS behavior, and retain build and deployment evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory applications and enclave images embedding aws-nitro-enclaves-sdk-c or kmstool-enclave, exact dependency versions, region inputs, build pipelines, owners, and deployed image measurements. Distinguish the example-application use-after-free from the SDK library issue; do not infer that every Nitro Enclave or AWS KMS caller includes the affected code. Upgrade the SDK to v0.4.6 and rebuild and redeploy every affected enclave image; AWS states there is no workaround for complete remediation. Confirm dependency locks and image measurements, test enclave startup, vsock and KMS attestation flows, verify deployments consumed rebuilt images, and retain SBOM, build and rollout evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS Nitro Enclaves SDK for C and the kmstool-enclave example application |
|---|---|
| Advisory | 2026-157-AWS |
| CVEs | CVE-2026-119116, CVE-2026-119148 |
| Authoritative release date | 2026-10-30 16:00:00 UTC |
| Authority revision date | 2026-10-30 16:34:46 UTC |
| Affected versions | aws-nitro-enclaves-sdk-c through v0.4.5; CVE-2026-119116 affects enclave images containing kmstool-enclave or derived code, while CVE-2026-119148 affects the SDK library's caller-supplied region handling. |
| Fixed version | aws-nitro-enclaves-sdk-c v0.4.6, followed by rebuilding and redeploying affected enclave images |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS fixed a kmstool-enclave use-after-free that can permit parent-instance code execution inside an enclave and region validation that can let a third party impersonate KMS and forge responses.
What To Validate Now
- Inventory. Inventory applications and enclave images embedding aws-nitro-enclaves-sdk-c or kmstool-enclave, exact dependency versions, region inputs, build pipelines, owners, and deployed image measurements.
- Establish applicability. Distinguish the example-application use-after-free from the SDK library issue; do not infer that every Nitro Enclave or AWS KMS caller includes the affected code.
- Remediate. Upgrade the SDK to v0.4.6 and rebuild and redeploy every affected enclave image; AWS states there is no workaround for complete remediation.
- Validate. Confirm dependency locks and image measurements, test enclave startup, vsock and KMS attestation flows, verify deployments consumed rebuilt images, and retain SBOM, build and rollout evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Updating a source dependency does not replace already deployed enclave images. Rebuilds can change measurements and policies, so coordinate and validate attestation dependencies.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
