Characterizing Trust Boundary Vulnerabilities in TEE Containers: An Empirical Study

TL;DR

This paper provides the first comprehensive analysis of TEE containers, revealing fundamental vulnerabilities and attack vectors that compromise their security, based on an automated benchmarking tool and empirical evaluation.

Contribution

It introduces TBouncer, an automated analyzer for TEE containers, and uncovers six attack vectors, twelve bugs, and three CVEs, highlighting security flaws in existing Tcons.

Findings

Uncovered six attack vectors in TEE containers.

Identified twelve new security bugs.

Discovered three CVEs related to TEE container vulnerabilities.

Abstract

Trusted Execution Environments (TEEs) have become a cornerstone of confidential computing, attracting significant attention from academia and industry. To support secure and scalable application deployment on confidential clouds, TEE containers (Tcons) have been introduced as middleware to shield applications from malicious operating systems and orchestration layers while preserving usability. In this paper, we present the first comprehensive analysis of Tcons, focusing on three critical layers: OS interfaces, encrypted I/O, and orchestration mechanisms. To enable systematic evaluation, we design TBouncer, an automated analyzer that precisely exercises and benchmarks Tcon isolation boundaries. Our study uncovers fundamental flaws in existing Tcons, leading to exploitable vulnerabilities such as code execution, denial-of-service, and information leakage. In total, we identify six attack vectors, twelve new bugs, and three CVEs. These findings provide new insights into the underestimated attack surface of Tcons and highlight key directions for building more secure and trustworthy container solutions.

Tables

Table 1. Table 1. Summary of TEE Runtimes and Containers

Category	Name	Mechanism	Platform	Activity	Usage	OS Interface
Compiler toolchain	Glamdring (lind2017glamdring)	Annotation	SGX	Inactive	$\circ$	Generated stubs (lind2017glamdring)
	Panoply (shinde2017panoply)	Annotation	SGX	Inactive	$\circ$	Panoply shim lib (shinde2017panoply)
Language runtime	MesaPy (mesapy_repo)	Interpreter	SGX	Inactive	$\odot$	Intel-SGX-SDK (sgxsdk)
	AccTEE (goltzsche2019acctee)	Wasm	SGX	Inactive	$⊚$	SGX-LKL-OE (sgx_lkl_repo)
	Twine (WAMR) (menetrey2021twine)	Wasm	SGX	Inactive	$⊚$	Intel-SGX-SDK
Two-way sandbox	Ryoan (hunt2016ryoan)	SFI	SGX	Inactive	$\circ$	NaCl loader (ryoan_code)
	Chancel (ahmad2021chancel)	SFI	SGX	- (Closed)	$\circ$	Intel-SGX-SDK
	Deflection (liu2021practical)	SFI	SGX	Inactive	$\circ$	Intel-SGX-SDK
Function in FaaS	Teaclave executor (teaclave_function_executors)	Wasm	SGX/TZ	Inactive	$⊚$	Teaclave-SDK (teaclave_sgx_sdk_repo)
	Enarx keeps (enarx_official)	Wasm	SGX/SEV	Monthly	$⊚$	Enarx shim layer (enarx_official)
	Veracruz engine (veracruz_repo)	Wasm	SGX/TZ	Yearly	$⊚$	Teaclave-SDK
	Oak function (oak_repo)	VM	SEV/TDX	Weekly	$⊚$	VirtIO (virtio)
Container	SCONE (arnautov2016scone)	SGX-aware libc	SGX	- (Closed)	$\bullet$	Ocall stubs (arnautov2016scone)
	SGX-LKL (sgx_lkl_repo)	LibOS	SGX	Inactive	$\bullet$	SGX-LKL-OE
	Ratel (cui2022dynamic)	DBT	SGX	Inactive	$\bullet$	Ratel-SGX-SDK (ratel)
	Gramine (tsai2017graphene)	LibOS	SGX	Weekly	$\bullet$	Customized PAL (gramine_repo)
	Gramine-TDX (kuvaiskii2024gramine)	LibOS	SGX	Monthly	$\bullet$	Specific VirtIO (gramine_tdx_repo)
	Occlum (occlum_asplos20)	LibOS	SGX	Monthly	$\bullet$	Teaclave-SDK
	Mystikos (mystikos_repo)	LibOS	SGX	Monthly	$\bullet$	OE SDK (openenclave_official)
	CoCo (CoCo)	VM	SEV/TDX	Weekly	$\bullet$	VirtIO driver

Table 2. Table 2. Tcon Boundaries across OS interfaces, encrypted I/O mechanisms, and orchestration layers

Tcon	OS Interface	Encrypted I/O Stack		Orchestration Control Interface
		Disk I/O	Network I/O	Runtime	Orchestrator
Gramine	Gramine PAL	Gramine PF (gramine_pfs)	Rakis (alharthi2025rakis)	rune (rune)	enclave-cc (enclave_cc)
Occlum	Ocall stubs	Async-SFS (occlum_async_sfs)	$\ast$	rune	enclave-cc
Mystikos	Ocall stubs	ext2fs (mystikos_ext2fs) (input protection) hostfs (mystikos_hostfs) (output persistence)	$\ast$	-	-
CoCo	VirtIO driver	dm-crypt (dm_crypt)	$\ast$	kata-shim (katacontainer)	coco-operator (coco_operator)

Table 3. Table 3. Interface Coverage Achieved by TBouncer

Tcon	Gramine	Occlum	Mystikos	CoCo
Syscall (Covered/Total)	169/169	158/163	179/203	248/248*
Coverage (%)	100.0	96.9	88.2	100.0

Table 4. Table 4. Summary of Vulnerabilities/Bugs in OS Interfaces.

Tcon	Memory Mgmt.	File I/O & FS	IPC	I/O Multiplexing	VirtIO Driver
Gramine	$△$	$○$ Leakage (ahmad2018obliviate)	$★$ Iago (Bug-8)	$△$	-
Occlum	$★$ Iago (Bug-1,2,3)	$★$ Iago (Bug-5,6)	$★$ Iago (Bug-9,10)	$■$ DoS (Bug-11)	-
Mystikos	$■$ DoS (Bug-4)	$△$	$△$	$△$	-
CoCo	$○$ Leakage (cross2024ccs)	$✓$	$✓$	$✓$	$★$ Iago (CVE-1)

Table 5. Table 5. Vulnerabilities in Disk I/O

Tcon	Issues
Gramine	Snapshot replay (gramine_encfiles) (CVE-2)
Occlum	Snapshot replay (code_release) (CVE-3)
Mystikos	Unencrypted hostfs (code_release) (Bug-7)
CoCo	Unverified mount (code_release; parma) (Bug-12)

Full text

Confidential computing, secure container, software vulnerability

††journal: PACMSE††journalvolume: 3††journalnumber: FSE††article: 0††journalyear: 2026††publicationmonth: 7††doi: 10.1145/3808159††ccs: Software and its engineering Software evolution††ccs: Security and privacy Software security engineering

1. Introduction

Trusted Execution Environments (TEEs) have advanced rapidly over the past decade to support scalable and robust data protection through hardware-assisted isolated execution. Representative examples include Intel SGX (sgx_official), AMD SEV (sev_official), and ARM TrustZone (trustzone_official). These technologies are increasingly adopted in security-critical applications such as password management (apple_passkey), secure networking (schwarz2020seng), blockchain systems (cai2021toward), and privacy-preserving data analysis (jin2024elephants).

Despite their potential, TEEs remain difficult to adopt in practice, largely due to limited compatibility with unmodified applications. For example, SGX typically requires developers to adapt applications using specialized SDKs (asylo_official), incurring substantial engineering effort. To bridge this gap, TEE middleware emerges as a crucial software layer, serving as an intermediary, hosting applications, and bridging the gap between TEE hardware and general-purpose software.

Containerizing TEE Applications. Despite the advancements in TEE middleware, their adoption remains challenging (paju2023sok). One of the key barriers to the widespread use of confidential computing has been the difficulty of application development and deployment. Some TEE runtimes address this challenge by enabling unmodified applications/containers to run directly within a TEE environment, bypassing the need for binary rebuilding. Examples include Gramine (tsai2017graphene) (formerly called Graphene-SGX), Occlum (occlum_asplos20), and Mystikos (mystikos_repo).

Our study focuses on this class of middleware as TEE container (Tcon). While Tcons significantly improve usability, they also increase the complexity of the TEE software stack.

Analyzing Tcon Isolation. The emergence of Tcons has introduced the convenience and transparency of running native code directly. With the industry’s growing demand for large-scale confidential service deployment (deml2024secureLLMs), such as for large language models, containerization provides clear advantages, including streamlined scheduling and on-demand orchestration (zobaed2023confidential). Tcons simplify TEE usage but complicate the software stack, raising concerns about their impact on TEE security. Our research surveys state-of-the-art Tcons from academia and industry using public sources (e.g., papers, developer guides, source code). We analyze their claimed security features, interfaces, and isolation principles, highlighting trust boundaries and undocumented issues. To demystify isolated execution in popular Tcons, we developed security benchmarks, called TBouncer, for the systematic evaluation of all the interfaces that need to be protected.

Contributions. Our contributions are summarized as follows.

$\bullet$* Systematic characterization of Tcon trust boundaries*. We conduct a comprehensive survey of TEE middlewares from both academia and industry (§ 2). We examine their isolation boundaries and security mechanisms across TEE-OS interfaces, encrypted I/O stack, and orchestration layers (§ 3).

$\bullet$* Automated boundary-driven security evaluation*. We design and implement TBouncer, an automated bidirectional analyzer that systematically exercises Tcon boundaries. TBouncer enables repeatable and scalable security evaluation by correlating enclave-internal execution with host-observable behavior (§ 4). Our tool is publicly released (code_release).

$\bullet$* Empirical findings and security insights*. Using TBouncer, we derive a taxonomy of six attack vectors and uncover twelve previously unknown vulnerabilities, including memory corruption, rollback, and denial-of-service (DoS) issues, three of which have been assigned CVEs. We report extensive empirical findings (§ 5), distill lessons and mitigation strategies (§ 6), and discuss applicability and limitations in broader TEE environments (§ 7).

2. TEE Middleware: Survey, Trends, and Taxonomy

In this section, we first introduce the background of commodity TEEs on the cloud in  § 2.1 and the original SDK-based programming model in  § 2.2. We then elaborate on the paradigm shift towards TEE runtime in  § 2.3, breaking down the inherent limitations of the TEEs’ original programming models and categorizing seminal solutions. After that, we explain the combination of containerization and TEE in  § 2.4. Related work is summarized in § 2.5 at the end of this section.

2.1. Hardware Trusted Execution Environments

Process-based TEE. Intel SGX provides application-level isolation by creating protected memory regions, called enclaves, for secure computation. However, SGX offers limited support for multi-process operations (e.g., fork) and requires developers to redesign applications to fit the restricted enclave environment, increasing the complexity of porting large and resource-intensive systems.

VM-based TEE. Emerging platforms such as SEV (sev_official), CCA (arm_cca_whitepaper), and TDX (intel_tdx_whitepaper) provide virtual machine-level TEEs. By introducing a full kernel layer, these platforms offer better compatibility and more flexible memory management, reducing reliance on specialized TEE runtimes. In confidential VM (CVM) deployments, the threat model assumes adversaries control all external inputs, including device I/O and interrupts.

2.2. From SDK to TEE Middleware

Intel’s SGX SDK and its driver were among the earliest tools supporting enclave development in TEE environments (sgxsdk). They provide low-level APIs and require developers to partition applications into trusted and untrusted components. This process is both technically challenging and labor-intensive, demanding careful design to maintain efficiency, correctness, and security. Moreover, language support is often limited, further constraining adoption. Subsequent frameworks, including the Open Enclave SDK (openenclave_official) and Rust SGX SDK (wan2020rustee), partially mitigate these challenges but still require familiarity with platform-specific models and substantial code refactoring (shanker2020evaluation). While improving compatibility, these SDKs continue to impose a steep learning curve.

2.3. TEE Runtimes: Abstractions for Compatibility

Software Compartmentalization. TEE architectures expose diverse host-OS interfaces, requiring SGX developers to handle these differences through often intrusive modifications. Solutions include compiler toolchains for rebuilding applications or runtimes that execute unmodified code.

$\bullet$* Compiler toolchains*. Frameworks such as Glamdring (lind2017glamdring) and Panoply (shinde2017panoply) automate trusted-untrusted separation using source-code annotations. Glamdring minimizes enclave transitions via static analysis, while Panoply isolates security-critical logic to reduce the TCB. However, both require manual annotations and substantial developer effort.

$\bullet$* LibOS-based solutions*. To ease integration, runtimes like Gramine (tsai2017graphene), SCONE (arnautov2016scone), Mystikos (mystikos_repo), and Occlum (shen2020occlum) implement Library OSes (LibOS) (porter2011rethinking) that execute unmodified Linux binaries inside TEEs. These runtimes intercept system calls, forward them securely across enclave boundaries, and handle exceptions externally for compatibility and confinement. This design eliminates the need for manual partitioning, improving developer usability.

Limited Language Support. Early SDKs primarily targeted C/C++, offering limited support for other languages. Later systems introduced mechanisms for portability and memory-safe execution.

$\bullet$* Language-specific runtimes*. Frameworks like MesaPy and Teaclave SGX SDK (teaclave_sgx_sdk_repo) enable Python and Rust in SGX. MesaPy embeds a PyPy runtime with verified memory safety (wang2020towards). These approaches often require enclave rebuilding, complicating deployment.

$\bullet$* Wasm runtimes*. Wasm sandboxes, e.g., AccTEE (goltzsche2019acctee), Twine (menetrey2021twine), and Enarx (enarx_official), abstract enclave interactions via a language-neutral format. Wasm modules can be interpreted or compiled inside TEEs using engines like V8 (v8_official) or WAMR (WAMR), supporting SGX and SEV platforms.

Advanced Usage Scenarios. While early TEEs mainly targeted single-process workloads, modern deployments require multithreading, multi-user isolation, and secure concurrent execution.

$\bullet$* Two-way sandboxes*. Systems such as Chancel (ahmad2021chancel), Ryoan (hunt2016ryoan), and Occlum (occlum_asplos20) employ Software Fault Isolation (SFI) (tan_gang_sfi) to confine untrusted processes within enclaves. Occlum initially relied on Intel MPX, which was later removed due to deprecation (intelmanual).

$\bullet$* Executors and integration*. Some runtimes act as modular executors within larger confidential computing frameworks. For example, Gramine and Occlum can be integrated into Teaclave, while Veracruz (veracruz_repo) and Oak (oak_repo) provide runtimes for Wasm-based workloads.

2.4. TEE Containers

As confidential computing moves to the cloud, containerization has become essential. With recent platforms (e.g., SGXv2) supporting large enclave memory, TEEs can now host server-grade container workloads, motivating the exposure of TEE runtimes through container-compatible interfaces.

In this paper, we define TEE containers, or Tcons, as a category of TEE runtimes that are capable of accommodating applications without the need for code modification and recompilation. According to the standard of the Open Container Initiative (OCI) (oci), a Tcon should support deployment through a root filesystem (rootfs or image) and a configuration file. As long as it complies with the OCI specification, it can be considered a container. Projects like runc (runc) and Kata (katacontainer) integrate these mechanisms, establishing a widely adopted standard among OCI-compatible container runtimes.

Process-based integration. Gramine Shielded Containers, Occlum, and Mystikos containerize their LibOS runtimes, encapsulating enclave execution within standard container workflows. Each exposes filesystem and configuration metadata, enabling seamless deployment on Docker or Kubernetes. They’ve gained traction due to their minimal application intrusion and increasing maturity.

VM-based integration. The Confidential Containers (CoCo) project, including its Kubernetes operator (coco_operator), integrates Kata Containers with VM-based TEEs (SEV/TDX). Each Pod runs inside a microVM, providing memory encryption and OS isolation (katacontainer). While improving compatibility, this architecture enlarges the TCB and introduces challenges for secure storage and remote attestation.

Cloud-native extensions. Beyond standalone containers, recent efforts aim to integrate TEE containers into cloud platforms. Examples include Ahmad et al.’s orchestration framework (ahmad2023extensible), Google Confidential GKE Nodes (confidential_gke), and Azure Confidential Containers (azure_cc), which support encrypted execution and confidential orchestration. Open-source projects such as Inclavare (enclave-cc) (inclavare_repo; enclave_cc) and Edgeless Contrast (constrast) further extend confidential computing to Kubernetes environments. Initiatives like CC-API (cc_api) seek to unify container interfaces across heterogeneous TEEs. Collectively, these efforts reflect the growing trend toward Confidential Kubernetes (constellation).

Figure 1 summarizes the evolution of SDKs, runtimes, containers, and orchestration layers over the past decade. Our evaluation focuses on three process-based Tcons (Gramine, Mystikos, and Occlum) and one VM-based Tcon (CoCo (CoCo)), which support “lift-and-shift” deployment of unmodified applications. Our survey covers active open-source projects up to Feb. 2026. Inactive, closed-source, or immature systems are excluded to ensure fairness and reproducibility. Table 1 summarizes major TEE runtimes and containers.

2.5. Previous Works

Several studies analyze the usability and portability of TEEs. Shanker et al. (shanker2020evaluation) examine trade-offs in porting legacy applications to SGX, while Li et al. (mengyuan2024sok) and Paju et al. (paju2023sok) provide comprehensive surveys of TEE architectures, applications, and performance. Mo et al. (mo2024machine) review privacy-preserving machine learning in TEE environments. None of the above surveys systematically investigate TEE containers as a deployment paradigm.

Prior research has also explored boundary vulnerabilities in enclave-based systems. Van Bulck et al. (van2017sgx) discuss API/ABI level sanitization vulnerabilities in shielding runtimes on SGX, TrustZone, and RISC-V. They analyze the bridge functions with vulnerabilities that can lead to exploitable memory safety and side-channel issues. Cui et al. (cui2021emilia) developed Emilia to automatically detect Iago vulnerabilities in SGX applications by fuzzing applications using syscall return values. Khandaker et al. (khandaker2020coin) introduced COIN attacks and proposed an extensible framework based on instruction emulation and concolic execution to assess enclave vulnerabilities. Cloosters et al. (cloosters2020teerex) developed TeeREX to automatically apply symbolic execution to analyze enclave binary code. Wang et al. (wang2023symgx) proposed SymGX, which employs static symbolic execution to detect cross-boundary pointer vulnerabilities in SGX applications by tracking pointer propagation. Alder et al. (alder2024pandora) introduced Pandora to apply principled symbolic validation to enclave runtimes, which uncover logic bugs and memory safety issues. These works primarily focus on SDK-based models and specific enclave interfaces. In contrast, our work targets the broader trust boundary exposed by TEE containers, including syscall interfaces and I/O paths, which arise from supporting unmodified applications.

3. Trust Boundaries of TEE Containers

Existing Tcon research lacks a systematic evaluation of trust boundary enforcement. In this work, we examine the isolation guarantees of representative Tcons by focusing on (i) externally exposed interfaces and (ii) their protection mechanisms. Our study classifies Tcon trust boundaries into three primary types: OS interfaces, encrypted I/O stacks, and orchestration interfaces, each serving distinct architectural roles.

As illustrated in Figure 2, application-level interfaces are mainly defined by Application Binary Interfaces (ABIs), which are primarily Linux ABIs with some POSIX-compatible variants. OS interfaces enable runtime communication between the TEE and the host OS. In process-based Tcons, this interaction is realized through OCall-to-syscall chains, while in VM-based Tcons it is mediated by paravirtualized devices such as VirtIO. These interfaces are essential for supporting secure I/O and resource management, but also constitute major attack surfaces that can be abused by a malicious host. At the orchestration layer, Tcons are managed by container runtimes and Kubernetes components, which expose control and management interfaces for deploying, scaling, and monitoring confidential workloads. While these interfaces enable efficient resource utilization and flexible multi-tenant management, they also introduce additional trust dependencies that may undermine isolation if improperly protected. Figure 2 provides a unified view of these interface layers and highlights the major trust boundaries examined in this paper. It further serves as a roadmap for the vulnerability analysis presented in § 5.1 - § 5.3, where we systematically investigate security issues across these layers. Table 2 summarizes the corresponding interface categories.

3.1. OS Interfaces

SGX-specific Interfaces. While various TEEs provide distinct isolation granularities depending on their architectural boundaries, interfaces like Ocall, Ecall, and exception handling are unique to SGX. User-land enclaves lack the capability to perform tasks like direct I/O or privileged memory mapping. To bridge the gap, process-based Tcons use Ocall stubs, which are wrapper functions enabling enclaves to invoke untrusted host services, and exception handlers, which manage events such as asynchronous exits. This layer serves as a lightweight mediator, delegating privileged operations to external handler libraries. Note that exitless Ocall mechanism (yuhala2023sgx) is implemented in some Tcons for performance enhancement (occlum_ngo).

Tcons heavily rely on Ocall stubs to request kernel services, though the degree of reliance varies across different Tcons. For example, Mystikos uses Tcall (tcall), a mechanism that directly invokes Linux syscalls. In contrast, Occlum processes most syscalls internally within its LibOS, treating these exceptions as custom operations. Once processed, these operations are forwarded to the host kernel for execution. This reflects their differing philosophies: Mystikos emphasizes direct syscall execution complemented by external security measures, while Occlum prioritizes internal exception handling and syscall abstraction within the enclave. Besides, Tcons differ in their support for raw syscall assembly instructions. Gramine routes raw syscalls and exceptions through its platform abstraction layer to the kernel. Occlum processes these exceptions internally as custom syscalls before forwarding them to the kernel.

3.2. Encrypted I/O Stacks

Figure 4 shows the I/O stacks of Linux storage and network. With networking, the interfaces can be sockets, TLS-encrypted TCP stack, etc. For storage, it can be file I/O and block I/O.

Disk I/O and Secure Storage. Confidential disk I/O is critical in the design of TEE containers, given the Unix-like principle that “everything is a file”. These interfaces must be carefully integrated into the TEE framework to ensure compatibility and security. In SGX-based Tcons, Disk I/O operations are mediated by Ocalls. Conversely, in VM-based Tcons leveraging technologies like TDX and SEV, Disk I/O often relies on VirtIO interfaces, such as virtio-blk, to facilitate interactions between the guest OS (Trust Domain/Secure VM) and the underlying hardware.

Tcons adopt diverse approaches to secure storage. For instance, Occlum provides a protected file system to shield data at rest, while Gramine introduces APIs for transparent encryption and decryption of file operations, minimizing the burden on developers. Mystikos currently supports three types of file systems: ramfs, ext2fs, and hostfs. For CoCo, secure storage is mainly implemented by integrating dm-crypt (dm_crypt) through cryptsetup (cryptsetup) as the encryption mechanism. These encrypted volumes, compatible with Kubernetes PodSpecs, are integrated into container workloads via a pause sidecar container. This sidecar handles initialization and mounts the encrypted block volumes, streamlining deployment without requiring modifications to the user’s Pod definitions. The encrypted storage is used for hosting container images, root filesystem writable layers, and other ephemeral data.

Network I/O. Tcons vary in their support for networks, with some relying on their own encryption mechanisms. Some Tcons only provide support at the I/O Multiplexing layer, and some opt to encrypt network packets within applications rather than using confidential network I/O, avoiding the need to modify the I/O stack but incurring additional performance costs. The current design of such interfaces is suboptimal, with LibOSes and guest VMs increasing the TCB size and still requiring I/O to pass through the host, leading to potential vulnerabilities and performance bottlenecks (bifrost).

From a systems perspective, different methods for secure network I/O map to distinct layers of the OSI model (lefeuvre2023towards). For instance, process-based Tcons’ interfaces often operate at Layer 5 (the session layer), leveraging socket abstractions provided by the operating system. These interfaces are inherently tied to TCP/UDP traffic but depend on the host for low-level processing. On the other hand, VM-based Tcons transfer network packets via the virtio-net interface.

3.3. Orchestration Control Interfaces

The Kubernetes Control Plane orchestrates cluster resources and maintains the system’s desired state. Key components like the API Server, Controller, and Scheduler manage and optimize containerized application deployment. The Container Runtime Interface (CRI) abstracts the Kubelet from specific container runtimes, enabling Kubernetes to interact with diverse runtimes via gRPC-defined interfaces. This supports OCI-compliant runtimes like cri-o and cri-containerd.

Kubernetes Pods can be seamlessly replaced by CoCo or other Tcons (e.g., Gramine and Occlum) using solutions like CoCo’s operator (coco_operator) or enclave-cc, a process-based runtime that manages TCon instances in Kubernetes. Each Tcon has its own container-style runtime approach. Gramine implements Gramine Shielded Containers (gsc), while Mystikos provides configurations through “config.json”. Occlum adopts a distinctive approach by introducing an initfs mechanism to manage its root filesystem. Through the control plane, the CRI, and the OCI, tenants can use kubectl (kubectl) to operate Tcons within their clusters.

3.4. Internal Isolation

Sandboxing Malicious Code. Unmodified code might be vulnerable or even malicious, necessitating robust protection from Tcons. This is particularly relevant in scenarios where service providers deploy proprietary code on cloud, and data owners, who are unable to audit the code, are concerned about potential privacy breaches (zhang2025erebor). In response, certain TEE executors aim to safeguard data confidentiality by sandboxing unmodified code. For example, the initial version of Occlum (occlum_asplos20) implemented SFI to secure hosted code, while Deflection (liu2021practical) introduced additional data protections over SFI. We found that the verifiers protect against indirect jumps but fail to adequately check direct jumps, which could be exploited to bypass security controls (code_release). This oversight could allow a malicious application to take over the enclave.

Multi-user/thread Support. A single TEE may also process data from multiple users who may not trust one another, necessitating robust intra-TEE isolation for different tenants. Thread isolation is critical, as the service code deployed within a Tcon, while not malicious, may contain vulnerabilities. Without proper thread isolation, a compromised thread could interfere with others, potentially escalating into a broader security breach (ahmad2021chancel). Some techniques have been proposed to build a reusable environment while ensuring non-interference between user threads within an enclave or a confidential VM (hongbo2023security; park2025pave). Approaches to address this have relied on binary instrumentation through modified compilation toolchains (zhao2023security) or hardware modifications (park2024taco).

Minimizing TCB. VM-based TEEs introduce unique challenges, notably expanding the TCB to include the entire kernel image and firmware components (such as UEFI/OVMF). This expansion has motivated research prototypes to replace the conventional Linux kernel with more lightweight and secure alternatives (asterinas). Additionally, the trust chain in VM-based TEEs extends only to the initial OS image, hindering the verification of the application’s integrity (narayanan2023remote). To address this, some solutions attempt to enable the creation of middleware within VM-based TEEs, isolating them from the feature-rich TEE OS (zhou2024verismo; wang2025road).

4. Fuzzing TEE Containers

In this section, we present TBouncer, a suite of security benchmarks specifically designed to uncover intricate issues across the above-mentioned interfaces. Our analysis targets x86-based TEEs, which dominate cloud and serverless deployments. ARM-based solutions, including TrustZone and CCA, are not the main focus of our empirical evaluation due to their distinct architectures and deployment maturity. Nevertheless, some vulnerability patterns are still applicable for mobile TEEs. We discuss the relevance and applicability in section § 7.

We evaluated Gramine (v1.5), Occlum (v0.30), Mystikos (v0.13.0), and CoCo (v0.11.0) following official documentation. SGX-based TCons ran on an Intel i7-1065G7 with 32 GB RAM; CoCo on AMD EPYC 7543 (SEV-SNP) and Intel Xeon 8568Y+ (TDX) with 488 GB RAM. Orchestration used enclave-cc for Gramine/Occlum and Kata shim plus CoCo-operator for CoCo.

4.1. Design and Implementation

Two-part Framework. Our methodology centers around a two-piece analyzer comprising a T-part component within the Tcon and a host-level component (H-part) outside it. This dual design enables test inputs to be injected either via the application running inside the Tcon or from the OS kernel, with responses monitored on the other end. Simply using tools like Trinity (trinity_repo) or AFL-derived fuzzers (kim2020hfl) can only test the Linux kernel unidirectionally, whereas our targets are fuzzing Tcons bidirectionally. By simulating real-world interactions, our framework evaluates Tcon protections, such as input sanitization and return value handling. Both components operate independently to systematically identify vulnerabilities in Tcon runtime interactions. The T-part generates diverse test cases targeting specific Tcon behaviors, while the H-part intercepts requests reaching the Tcon, inspects them, and can send back crafted responses to test the robustness of Tcons.

As shown in Figure 3, TBouncer uses eBPF (ebpf) for precise syscall interception and control, monitoring in-kernel syscall processing (e.g., parameters in sys_read for read calls) (jia2023programmable). We then adapt kAFL (schumilo2017kafl) to simulate inputs sent to the bounce buffer from the host, enabling comprehensive Tcon-host interaction analysis.

Despite the advantages of this 2-piece framework, one key challenge in analyzing Tcons lies in their strong isolation, while the host cannot perceive the application running within the TEE, complicating automated analysis. Kernel fuzzing tools such as Syzkaller (syzkaller_repo) also employ a two-part approach; however, they cannot be directly applied in this context due to two key limitations: (1) the inability to synchronize between the two components when the user-space part operates within a TEE, and (2) the lack of support for generating reverse test cases from the host to Tcons.

Precise Synchronization using Cgroups. To effectively monitor syscalls issued from T-part, filtering out interference from other host processes is essential. While one approach is to use eBPF to capture syscalls from specific process IDs (PIDs), this method has limitations, especially when multiple Tcon processes are running on the host concurrently. In practice, a Tcon may fork additional helper or child processes, meaning that tracing only the initial parent PID is insufficient to capture the full execution context.

To identify different Tcon processes, TBouncer leverages cgroups. The cgroup feature, which ensures that all child processes forked from a parent remain in the same cgroup, enables Tbouncer to comprehensively track all processes associated with Tcon and their activities. Using cgroups, TBouncer groups all processes associated with a Tcon into a clean, isolated cgroup. This eliminates the need for the H-part to track multiple PIDs individually, as child processes automatically inherit their parent’s cgroup. The H-part then focuses exclusively on monitoring behaviors belonging to this cgroup, simplifying and streamlining syscall/DMA mutation.

To facilitate communication between the isolated Tcon and the host, TBouncer leverages a shared volume, a common debugging mechanism existing in all Tcons (Gramine_sv; occlum_async_sfs; mystikos_hostfs). This shared volume ensures precise signal exchange between the T-part and H-part with a designated signal file.

Logging and Analyzing. TBouncer’s logging module facilitates in-depth analysis, enabling detailed analysis of parameters and behavior. Using these traces, the analyzer identifies which input parameters may have weaknesses and examines whether the sanitization mechanisms are implemented. To achieve this, TBouncer’s logging module compares parameters captured from both the T-part and H-part. This ensures comprehensiveness, exposing potential bugs in both Tcons’ input handling and output sanitization.

4.2. Input Generation Strategy

Generating Syscalls. Syscall handling in Tcons varies: some syscalls are processed entirely within Tcons, bypassing the untrusted OS; others are unimplemented, conditionally handled, or forwarded to the host OS with modifications. For instance, a LibOS might translate a read syscall into pread by appending an offset. To enable the host OS to perceive the application’s behavior running inside the T-part more accurately, We modified the Linux Test Project (LTP) (ltp), adapted to various Tcons by resolving dependencies and compatibility issues. And the T-part traverses syscall parameters and nested data structures, recursively dereferencing pointers to capture comprehensive information.

Crafting Iago-specific Tests. Iago is an attack in which a malicious kernel manipulates syscall return values to trick a protected process into acting against its own interests (checkoway2013iago). In VM-based TEEs, we extend this concept to malicious hypervisors, which could hijack the DMA interface and inject malicious input. TBouncer also generates test cases to evaluate Tcon’s resistance to Iago attacks. We consider both injecting syscall return values from the host kernel and VirtIO parameters from the device side. We introduce the concept of nested structuring, which is strategically employed to populate syscall arguments and virtqueue descriptors. Furthermore, we simulate the interactions occurring at the boundaries of these structures by adapting and leveraging kAFL (schumilo2017kafl). To mutate the values from the LibOS/VM to the host OS at specific layers, we leverage eBPF to hook into critical functions (e.g., sys_epoll_wait and sys_readlink) associated with each data structure.

Stateless Fuzzing. To ensure stability and prevent interference with subsequent testing cycles, TBouncer performs a thorough cleanup at the end of each cycle. This includes unmapping memory regions, closing file descriptors, and properly joining threads. These steps ensure that each fuzzing iteration starts from a consistent and isolated state, avoiding unintended side effects and improving the reliability of the testing process.

4.3. Coverage and Performance

Instead of measuring traditional code coverage, we evaluate TBouncer in terms of interface coverage, i.e., the extent to which exposed trust boundary interfaces are systematically exercised. A detailed discussion on the limitations of conventional coverage metrics is provided in Section 7.

Note that Tcons typically support only a subset of Linux system calls and may additionally introduce customized system interfaces. For syscall interfaces exposed to the untrusted OS, our security benchmark covers nearly all supported syscalls in process-based Tcons: 169/169 for Gramine, 158/(158+5) for Occlum, and 179/(179+24) for Mystikos. Here, the additional syscalls correspond to Tcon-specific extensions implemented within the LibOS. As these interfaces are not part of the standard Linux ABI and lack standardized specifications, TBouncer currently does not provide dedicated fuzzing models for them and therefore does not systematically exercise these interfaces.

For VM-based Tcons, we exercised all 248/248 forwarded system calls in CoCo. In addition, the current implementation of CoCo supports five VirtIO devices, namely virtio-blk, virtio-net, virtio-console, virtio-9p, and virtio-vsock. We tested all exposed device interfaces and achieved full coverage (5/5). Table 3 summarizes the results.

Furthermore, we evaluate the practical performance in terms of fuzzing throughput and testing effort. All experiments were conducted on our Intel Xeon 8568Y+ workstation running a Linux 6.8.0 kernel as the host OS, with a fixed time budget of 2 hours for process-based Tcons and 24 hours for VM-based Tcons. This budget proved sufficient to comprehensively explore exposed trust boundary interfaces, as both fuzzing throughput and vulnerability discovery stabilized substantially earlier—typically within 1 hour for process-based targets and 12 hours for VM-based targets.

During fuzzing, TBouncer continuously exercised Tcon boundary interfaces and monitored executions for abnormal behaviors, such as crashes, assertion failures, and inconsistent outputs. Detected anomalies were automatically logged with execution traces. In particular, for DMA-related failures, TBouncer ensured that relevant buffers were properly initialized before issuing the triggering commands. Vulnerabilities identified are reported in detail in Section 5.

5. Findings

We analyzed the recorded execution traces to validate reproducibility and confirm genuine security vulnerabilities, which were responsibly disclosed to the corresponding Tcon developer communities for verification and remediation. We next present our findings from three perspectives: Iago-style attacks on OS interfaces, insufficient I/O encryption, and issues in orchestration layers.

5.1. Iago-style Issues and Beyond

As analyzed in Section 3, issues arise when Tcons interact with the host OS, potentially exposing sensitive data or undermining the security model. We report vulnerabilities in Tcon’s memory management subsystem, file I/O, inter-process communication (IPC), I/O multiplexing, and virtual drivers. Figure 4 shows the existing protections in each part and highlights the boundaries and attack surfaces correspondingly. To ensure the robustness of our findings, we engaged with the authors of related papers and developers of the selected Tcons. Their feedback helped validate our discoveries, refine interpretations, and identify key insights for the future evolution of Tcon technologies. Table 4 summarizes the issues.

5.1.1. Incomplete Memory Management

Linux memory management is one of the kernel’s most intricate subsystems, supporting diverse functionalities. In SGX-based LibOS implementations, only a minimal subset is reimplemented to simplify design and maintain compatibility with unmodified applications. All Tcons enforce basic address space isolation (e.g., ensuring that returned addresses fall into enclave memory regions), but advanced support remains incomplete.

Attack Vector 1: Syscall-level Iago Attacks. Tcons frequently exhibit semantic deviations or incorrect return values in system calls, enabling Iago-style attacks. Such deviations allow malicious hosts to subvert enclave semantics, resulting in corrupted data, and unauthorized access.

Gramine implements core syscalls such as mmap, munmap, msync, and mprotect, but omits advanced flags and calls. For instance, MS_INVALIDATE in msync, and calls like mincore, mlock, and munlock are unimplemented, which can cause performance degradation for applications relying on these features. Mystikos adopts an even stricter approach by enforcing configurable limits on stack and heap memory. Applications must be tuned to remain within these bounds, as exceeding them can result in crashes or out-of-memory errors (code_release), underscoring the fragility of memory management in SGX-based environments (mckeen2016intel).

Occlum, implemented in Rust, benefits from memory safety guarantees that reduce many low-level risks. However, our benchmark revealed vulnerabilities, illustrating how incomplete memory management can lead to Iago-style issues. For example, when mmap maps a file, the memory area beyond the file’s end should be zero-filled. Instead, Occlum returned anomalous values (code_release), allowing unintended modification of data beyond the file boundary, potentially corrupting file content. Similarly, mprotect incorrectly succeeds in granting write access to read-only mappings (code_release). This flaw enables malicious modification of sensitive files (e.g., configurations, binaries, or logs) that should remain immutable.

In VM-based Tcons, adversaries can further exploit CoCo’s insufficient memory isolation to induce a wide range of attack effects. Prior work reports a cross-container memory disclosure attack in which a malicious container is deployed alongside a victim container (cross2024ccs). Once the attacker container is launched within the same sandbox, embedded scripts enumerate the memory mappings of processes inside the victim container, dump their contents, and transfer them to the host file system for offline analysis. This attack is primarily enabled by incomplete isolation of process visibility and memory management metadata inside the confidential VM, as well as overly permissive control interfaces that lack fine-grained authorization between co-located containers.

5.1.2. Incomplete File I/O

Gramine, Occlum, and Mystikos provide basic filesystem capabilities, supporting syscalls such as read, write, lseek, open, and close. However, many advanced features remain unsupported or only partially implemented. For instance, event monitoring via inotify is not available, while file linking and locking mechanisms (e.g., fcntl) are restricted. Moreover, Gramine and Mystikos isolate each process in a separate enclave, thereby fragmenting filesystem metadata across enclaves. This design prevents dynamic filesystem mounting, makes cross-process file synchronization infeasible, and leads to non-interruptible file locking.

Semantic Deviations in Syscalls. The readlinkat syscall is expected to return an EINVAL error when invoked with bufsiz set to ‘0’. However, our security benchmark found that Occlum unexpectedly returned Success under these conditions (code_release). This anomaly introduces a risk of writing to an unallocated or improperly sized buffer, potentially leading to memory corruption. Furthermore, this vulnerability could be exploited by attackers to perform DoS through repeated calls. Similarly, the sendfile is expected to return an EBADF error if the output file descriptor lacks write permissions (code_release). However, Occlum was observed to incorrectly return Success in such cases. This flaw could allow unauthorized writes to restricted files, bypassing access controls. These scenarios could potentially enable misuse by applications.

5.1.3. Untrusted IPC

Linux Inter-Process Communication (IPC) relies on mechanisms like memory sharing, semaphores, and message queues. Memory sharing provides access to the same physical memory across processes. However, we found that the single-enclave-per-process architectures of Gramine and Mystikos introduce challenges for fully implementing IPC. Implementation of POSIX semaphores is insecure, as semaphores are placed in shared memory which by design is allocated in untrusted non-enclave memory, and there is no way for Gramine to intercept memory accesses to shared memory regions (to provide some security guarantees) (gramine_semaphores). Meanwhile, POSIX-based implementations such as GPU communication, remain unsupported in both systems.

Attack Vector 2: Untrusted Shared Memory. Reliance on host-allocated shared memory exposes Tcons to tampering, leakage, and threatening system stability through manipulated IPC behavior.

Achieving both robust isolation and high IPC performance in enclaves is challenging. Gramine-SGX assigns an enclave to each process. Meanwhile, Gramine-TDX extends Gramine LibOS by incorporating a layer of vsock and virtio_fs (virtio_fs), and it boots in the TDX environment. Consequently, when Gramine performs IPC, it needs to facilitate communication across enclaves or TDs, which incurs significant overhead. Occlum, with its single-enclave process model, consolidates data and different threads within the same enclave, allowing memory sharing. This design prioritizes performance. Occlum’s throughput on pipes is approximately 10 times that of Gramine (occlum_vs_gramine).

Nevertheless, our tests still reveal several IPC limitations of Occlum. For example, shmget inconsistently allocates shared memory sizes, while shmat restricts the shmaddr parameter to ‘0’ or the starting address of a memory segment, disallowing manual address specification for security reasons. Additionally, the memory size reported by shmctl may differ from the allocated size (code_release). Such anomalies not only hinder compatibility with legacy applications but also introduce risks of undefined behavior, potentially leading to memory corruption or DoS in certain scenarios.

5.1.4. I/O Multiplexing and Event Handling

Efficient management of concurrent I/O events is essential for high-performance and scalable systems. Linux provides three primary APIs for this purpose: select, poll, and epoll. Both select and poll rely on linear data structures to track file descriptors, resulting in scalability limitations as the number of monitored sockets increases. In contrast, epoll adopts an event-driven mechanism that notifies applications only when registered events are triggered, offering better performance for large-scale workloads.

Attack Vector 3: Resource Exhaustion. Weak enforcement of resource limits and epoll misuse allow attackers to trigger deadlocks, exhaust resources, and induce DoS through crafted I/O patterns.

Gramine and Occlum support all three I/O multiplexing APIs by emulating the host’s ppoll syscall, allowing the implementation of select, pselect, poll, and epoll related syscalls. However, we identified several issues in their implementations. In Gramine, the epoll syscall does not handle the EPOLLWAKEUP flag due to a lack of automatic resumption support. Additionally, Gramine restricts epoll usage: processes cannot share epoll instances, and nesting of epoll instances is unsupported due to enclave isolation. These limitations arise from Gramine’s focus on process isolation and security, sacrificing flexibility for enhanced security. Occlum, on the other hand, has issues with epoll as well. It allows two epoll instances to listen to each other, causing deadlocks due to nested loops. Furthermore, there is no limit on epoll nesting, leading to potential resource exhaustion (code_release).

These limitations involve both security and performance trade-offs. In Gramine, restricting epoll sharing and nesting limits inter-process communication, hindering scalability for complex I/O workflows. In Occlum, the lack of restrictions on epoll nesting introduces risks of deadlock and resource depletion. The design choices to limit or disable epoll sharing and nesting are intended to preserve enclave isolation but come at the cost of reduced performance and flexibility for high-concurrency, I/O-bound applications.

5.1.5. Vulnerable Drivers and Device Interfaces

VM-based TEEs are vulnerable to several security risks, particularly those arising from the exposure of device-shared pointers, Direct Memory Access (DMA) buffer control, and memory management flaws. These vulnerabilities, commonly associated with VirtIO drivers, present significant threats to system integrity and security. The following cases illustrate some of the specific risks and the Linux kernel patches designed to mitigate them.

Attack Vector 4: Malicious DMA Manipulation. Paravirtualized drivers (e.g., VirtIO) expose enclave/VM pointers and rely on DMA descriptors from the untrusted host, causing out-of-bounds writes or code execution. This attack can be viewed as a VM-level variant of Iago attacks.

Uncontrolled Device-accessible Pointers. In the network interfaces, a driver’s pointer could be shared with an untrusted device. However under the threat model of TEE, when exposed to the untrusted hypervisor, it reveals the virtual machine’s randomized address space. This exposure opens the door for malicious overwrites from the host OS/hypervisor, as an attacker could potentially compromise the pointer and redirect execution by crafting sk_buff objects, which can be fuzzed out by TBouncer. Specifically, when performing DMA memory access within Tcon, VM snapshots are taken. TBouncer pinpointed the page and continuously randomized the data returned by the host. By exploiting kernel function pointers, an attacker could then gain unauthorized code execution and then commit a practical attack (via2021acsac).

Out-of-Bound Access. Another common vulnerability stems from DMA buffer overflows. When device-managed DMA descriptors are not properly validated, a malicious device can inject arbitrary values into the descriptor ring, potentially causing buffer overflows. This exploitation can adversely affect the VirtIO driver. To find such issues, TBouncer tracks in-buffer lengths and injects data that exceeds these limits. For example, we found that a lack of validation for the hash_key_length parameter in the virtnet_probe function can lead to out-of-bounds errors (code_release). Various critical metadata (e.g., address, length, flag) from the device-controlled descriptors all suffer from the issue, which can result in memory corruption, and then lead to malicious code execution.

Insight 1.

In TEE middleware, host-facing interfaces are inevitable yet untrusted. Our study shows that different Tcons resolve this tension differently: some expose broader syscall and I/O surfaces for compatibility and performance, thereby enlarging the Iago attack surface; others enforce stricter confinement to reduce exposure, but at the cost of breaking legacy functionality and increasing development overhead.

5.2. Insufficient I/O Security

While memory inside TEEs is transparently encrypted by hardware, I/O operations are not. Thus, the responsibility of securing disk and file interactions falls onto the Tcon software. However, existing designs remain insufficient: even with encryption, leaks through syscalls and weaknesses in persistent storage still expose sensitive information.

5.2.1. Leaky I/O Metadata

Process-based Tcons rely on the untrusted host kernel to handle I/O requests, inevitably exposing sensitive metadata to the OS. For example, during file operations, the kernel can infer details such as which file is being accessed, the specific offsets of read or write operations, and the access patterns. Even with encrypted filesystems, metadata leaks (such as file size, access timestamps, or offset patterns) can reveal sensitive insights, potentially compromising data confidentiality (chen2020metal). For instance, if a database server runs on these Tcons, attackers may exploit offset information from read operations to learn access patterns or deduce which parts of a file are being accessed. Similar risks exist in network I/O, where unencrypted metadata such as packet length, block size, or timing patterns can leak application behavior and workload characteristics. Consequently, detailed information may still be inferred by an adversary (ahmad2018obliviate).

Gramine employs a hybrid filesystem model (gramine_repo), storing data on disk files with a specific encrypted format. However, operations on external files still expose access patterns to the kernel, undermining the confidentiality of sensitive workloads. Occlum, in contrast, implements measures to mitigate such threats. It employs an in-enclave filesystem to prevent file operations from being exposed to the untrusted OS. By caching upper-layer file I/O through its asynchronous filesystem (Async-SFS) (occlum_async_sfs), Occlum both improves disk I/O performance and reduces metadata leakage, thereby enhancing security and anonymity. Preventing such leakage is a cross-cutting issue for Tcons, spanning both disk and network I/O, and requires careful design beyond encryption alone.

5.2.2. Broken Persistent Storage

In the context of Tcons, writing data from memory to storage (e.g., hard disk) refers to transparent confidential persistent storage, where we identified a number of potential vulnerabilities. Given that the host has full observability, attackers can replace any components outside the TEE. Therefore in addition to ensuring availability and confidentiality, some primary attack vectors also must be addressed: (1) data corruption due to the absence of mounting integrity checks; and (2) replay attacks arising from a lack of freshness.

Lack of Availability or Confidentiality. In Mystikos, the ext2fs implementation relies on dm-verity, which is designed for read-only file systems and does not protect write operations. The lack of journaling in ext2fs means that data is not safeguarded against application crashes, with modifications lost when the application exits (mystikos_ext2fs). Hostfs, designed for data exchange between the LibOS and the host, operates without protection mechanisms (mystikos_hostfs). To strengthen Mystikos, enhancing the confidentiality and integrity mechanisms for all filesystem types is essential.

Lack of Mounting Integrity. In CoCo, a malicious host can exploit weaknesses by loading an encrypted container image onto the host and mounting it into the guest, where it is decrypted by the attestation agent (coco_issue_162). Once decrypted, the host gains visibility into sensitive data and can modify the container’s root filesystem, potentially altering workload behavior. This vulnerability stems from CoCo’s failure to validate mounted resources within the guest. To address this, the agent should verify volumes and include them in attestation evidence through security policies.

Attack Vector 5: Snapshot Replay. Weak guarantees of atomicity and freshness let attackers tamper and replay with transient snapshots, enabling file rollback or corruption.

Lack of Freshness and Atomicity. File operations in Occlum and Gramine lack atomicity and freshness, exposing critical vulnerabilities. Occlum’s disk model allows adversaries to capture and replay transient snapshots, compromising application logic (occlum_snapshot). Similarly, Gramine’s Protected Files (PF) library (gramine_pfs) uses an in-enclave LRU cache, flushing intermediate files to disk when full. These truncated snapshots can be intercepted and manipulated, enabling attackers to tamper with critical files like “redis.conf”. For example, missing fields such as requirepass in truncated snapshots can let attackers bypass authentication. Both systems fail to ensure atomic writes or validate snapshot freshness, enabling replay and truncation attacks. We reported them to the community, and a CVE was assigned to these vulnerabilities.

Addressing these vulnerabilities requires robust mechanisms to enforce atomicity and preserve snapshot integrity and freshness. Intel released a patch (intel_patch) allowing larger cache sizes, reducing eviction frequency and thus transient snapshot generations. Gramine also considers a pre-allocated free-list cache as mitigation (gramine_issue_1714). These minimal-engineering strategies are understandable but remain inadequate, as they still lack atomicity and freshness even with fewer transient snapshots.

Insight 2.

Encryption alone does not secure TEE I/O. Transient states such as snapshots, cache flushes, and intermediate files must be protected for integrity, freshness, and atomicity. Without these guarantees, adversaries can replay, truncate, or reorder encrypted data, leading to configuration bypasses, stale state, or corrupted application logic.

5.3. Untrusted Orchestration Interfaces

As shown in Figure 2, the orchestration flow from the control plane to the OCI-shim exposes multiple attack vectors that threaten the security of confidential and containerized environments. The unprotected container shim can introduce vulnerabilities by transmitting compromised container/VM images or guest agents during instantiation. Furthermore, the container runtime has the capability to alter or fabricate virtual hard disks, using these as layers for image construction, potentially embedding malicious code. Similarly, the shim can manipulate container filesystems by selecting arbitrary layers, injecting backdoors, or introducing environment variables and commands that exacerbate security risks. Additionally, remote communications remain vulnerable to interception or manipulation, facilitating man-in-the-middle attacks.

5.3.1. Unprotected Control Plane and CRIs

This subsection presents our empirical findings on security weaknesses introduced by Kubernetes-based orchestration in confidential container deployments. Through systematic boundary testing, we observe that while low-level TEE isolation remains intact, security guarantees are often undermined at higher layers by control-plane and Container Runtime Interface (CRI) components defined in the Kubernetes ecosystem. These externally exposed orchestration interfaces, though essential for large-scale management, become critical attack surfaces when their integrity and access control are insufficiently enforced.

Unprotected Control Plane. The Pod-centric security model in CoCo does not adequately safeguard high-level workload resources. If the Kubernetes control plane is compromised, the Pods may not function as intended by the users. For instance, when a new StatefulSet is created, such as for a MySQL service, the controller is responsible for spawning a series of Pods with identical images but distinct numerical suffixes, ranging from ‘0’ to ‘N’. The suffix determines whether the Pod is configured as a leader or a follower, which MySQL then uses to load its configuration. However, if an attacker were to maliciously initiate two Pods with the same suffix, such as ‘0’, this would result in two leader Pods operating concurrently, thereby jeopardizing data integrity. Such attacks occur when components in the control plane (e.g., controllers) are not protected, or their execution integrity is not verified.

Attack Vector 6: Orchestration Interface Exploits . Weak CRI protections enable access control bypass, RCE, or privilege escalation, while host-mediated APIs (e.g., settime) let adversaries disrupt application logic and compromise control-plane integrity.

Unprotected CRIs. These vulnerabilities are meta-level issues that require careful consideration during the design and implementation of secure container orchestration systems.

Specific vulnerabilities highlight the insecurity of these CRIs. For instance, an improper access control flaw allows attackers to steal credentials and compromise resources beyond the intended security scope, including confidential guests and containers outside their designated network boundaries (cve_2024_29990). Similarly, remote code execution and privilege escalation vulnerabilities let attackers gain unauthorized control to compromise the host and its dependent resources (cve_2024_21376).

Moreover, untrusted timing mechanisms and host-controlled interfaces exemplify how the control plane and CRIs remain exposed. Adversaries can manipulate clocks, timers, or API calls to disrupt applications or exploit subtle inconsistencies. Our testing revealed that even trusted runtimes like Gramine, Mystikos, and Occlum can be affected by host-mediated timing errors (code_release), underscoring the need to protect control plane components and their interfaces. Furthermore, the settime API exemplifies the risks of insecure design in CoCo (cross2024ccs).

Unprotected Control Commands. Another issue is that control commands from the untrusted host are not isolated. For example, the host can use ‘kubectl exec’ to run arbitrary commands. It can also solicit debugging information via ‘kubectl logs’ from the running Tcons, which may include access to input/output operations, call stacks, or container-specific properties.

5.3.2. Insecure OCI and Container Metadata

Our analysis shows that insufficient protection of OCI artifacts and container metadata introduces a critical attack surface in Tcon deployments. Although application code is executed inside TEEs, key configuration files, image layers, and runtime parameters are often managed outside the trusted domain. As these metadata directly govern enclave initialization and execution semantics, their weak confidentiality and integrity guarantees enable adversaries to manipulate container behavior without violating hardware-enforced isolation.

Unencrypted Container Configuration. An adversary may engage in various activities that compromise the integrity and confidentiality of containerized environments, especially by manipulating the “config.json”, thereby subverting the operational parameters.

Block devices, which store both immutable container image layers and the mutable scratch layer, are susceptible to unauthorized modifications. This can lead to the introduction of malicious code or the corruption of the container’s filesystem. Attackers may manipulate container definitions in several ways: (1) reordering or injecting malicious layers into the overlay filesystem disrupts the integrity of the runtime environment; (2) modifying environment variables or altering user-specified commands allows adversaries to insert backdoors or introduce malicious behavior; (3) by modifying mount points, attackers can redirect container processes to compromised or unauthorized resources. For instance, vulnerabilities (cve_2024_21403) reveal how improper files or directories within these layers can be exposed to unauthorized external access.

Lack of Configuration Content Validation. To ensure the security of applications running within enclaves, Tcons must protect not only the application but also its associated metadata. For arguments and environment variables with indeterminate content prior to enclave loading, security sanitization is essential. An interesting case arises with Gramine-TDX, which moved its manifest file into the trusted domain. However, transferring configuration files into the VM remains a challenge. For instance, replacing insecure file-transfer methods like ‘kubectl cp’ with alternatives like ‘scp’ could mitigate these risks. Occlum incorporates arguments, environment variables, and configurations into its attestation process via initfs, ensuring their integrity, while also verifying and securely storing metadata for runtime-uploaded code.

Insight 3.

Orchestration interfaces extend the Tcon attack surface: weak CRIs, unvalidated OCI metadata, and unprotected control-plane logic enable layer injection, command tampering, or scheduling subversion, undermining cluster-wide confidentiality and integrity.

6. Lessons Learned and Mitigation Strategies

Confidentiality, Atomicity, and Freshness of OS Interfaces. Tcon developers must minimize exposed OS interfaces, not only by reducing the number of I/O interfaces but also by sanitizing their parameters to ensure secure interaction with the underlying system. Developers should provide mechanisms for auditing or allow users to configure these interfaces to disable unnecessary calls, mitigating the risk of misuse and snooping. For network I/O, enhanced solutions like Rkt-io (rkt_io) and Rakis (alharthi2025rakis) offer universal and transparent encryption across the I/O stack, ensuring both confidentiality and integrity of data entering and leaving the TEE.

For disk I/O, some ongoing projects like MlsDisk (sworndisk) provide a virtual block device that enhances security while maintaining performance. We need a solution that can guarantee atomicity by ensuring that all writes are completed only upon a successful sync operation. CoCo ensure block-level integrity, using authentication tags for writable filesystems. However, these tags are vulnerable to replay attacks and do not ensure data freshness. The potential adoption of integrity trees, such as Merkle Trees, could address freshness concerns, but the cascading updates required along the root-leaf path impose significant latency and bandwidth overheads. Future research should explore security-performance trade-offs in I/O to balance data freshness and operational atomicity.

Split APIs vs. Container Metadata Validation. Recent CoCo proposals aim to mitigate security risks but face critical limitations. One proposal introduces a policy engine to enforce tenant-defined configurations. The container metadata validation (container_metadata_validation) provides attestation rooted in hardware-issued trust, enforcing user-specified execution policies. This mechanism extends the guest agent to ensure it only executes commands explicitly authorized by the tenant. The execution policy, defined and cryptographically measured by the user, is integrated into the attestation report (parma). However, this approach couples release policies tightly to specific execution policies, necessitating comprehensive revisions when container images require updates (e.g., for critical patches). While this rigid coupling enhances security, it may lack the flexibility some scenarios demand, where broader definitions of permissible actions are preferred. Future research could explore ways to maintain rigorous security guarantees while accommodating more dynamic policy definitions.

Another CoCo’s proposal separates APIs into host-side (non-sensitive) and owner-side (sensitive) (splitapi; cross2024ccs). More specifically, in-Pod command execution is classified as owner-side, while Pod creation/deletion is host-side. Despite this categorization, the approach fails to adequately demonstrate immunity to vulnerabilities across host-side APIs, leaving attack surfaces unaddressed.

Confidential Kubernetes. The need for secure, multi-tenant Kubernetes solutions has driven the adoption of VM-based Tcon for private cluster protection and efficient resource management. These advancements position confidential orchestration frameworks as a new cornerstone.

CoCo provides minimal protection by isolating individual Pods within their TEEs, establishing a targeted security boundary while emphasizing lightweight modifications to the Kubernetes architecture. In contrast, confidential Kubernetes employs a monolithic protection model, encapsulating the entire Kubernetes stack within VM-based TEEs, as demonstrated by Constellation (constellation). This model ensures the security of all cluster operations through trusted nodes and encrypted communications, leveraging advanced CNI plugins (cilium). These evolving approaches highlight the trade-offs between granularity and scalability in secure orchestration, paving the way for future innovations in confidential computing for cloud-native environments.

7. Discussion

Limitation and Generalizability. This work primarily targets commodity x86-based TEE containers deployed in cloud environments. As a result, the current implementation of TBouncer is not directly applicable to all TEE platforms or middleware systems. Nevertheless, both our design principles and empirical findings have broader implications for the security analysis of TEE.

At a high level, TBouncer is built upon a bidirectional synchronization and boundary-focused fuzzing model, which applies to TEE systems that expose well-defined interaction interfaces between trusted and untrusted components. CoCo, a CVM-based Tcon, exemplifies TBouncer’s capabilities on supporting diverse architectures. As TrustZone-based and SGX-based TEEs rely on Rich-OS/Trusted-OS and host/enclave boundaries, respectively, they are similar to the trust boundaries faced by TBouncer. Prior studies have shown that this boundary is susceptible to Iago-style attacks (cerdeira2020sok), which aligns with our findings in § 5.1. Similar boundary-induced vulnerabilities have also been reported in TrustZone-based systems, where the untrusted Rich OS can manipulate inputs to the secure world or tamper with I/O responses returned to trusted components, thereby affecting trusted execution (lentz2018secloak). With appropriate enumeration of vendor-specific boundary interfaces, such as Secure Monitor Calls and GlobalPlatform APIs, TBouncer can be adapted to this setting to uncover such vulnerabilities systematically.

Evaluation Metrics of TBouncer. Our results suggest that, for TEE middleware, assessing how thoroughly trust boundary interfaces are exercised is often more informative than relying solely on traditional fuzzing metrics such as code coverage. In TEE environments, accurate coverage measurement is challenging due to limited observability, restricted instrumentation, and distinct runtime implementations. We note that security properties unrelated to boundary enforcement, such as internal enclave logic, are orthogonal to our study and are not the primary targets of TBouncer. Thus, as our primary focus is on the trust boundaries of Tcons rather than fuzzing the entire Tcon, code coverage veils the actual breadth of exploration on those interfaces.

8. Conclusion

Our study shows that today’s Tcons provide insufficient protection and lack transparency regarding their security guarantees. We proposed and implemented a suite of benchmarks to systematically evaluate Tcons, uncovering new bugs (including 3 CVEs) and providing guidance for developers and users. We conclude with key takeaways and call for greater community attention to advancing techniques for securing current Tcons and informing future designs, hoping our findings serve as a foundation for the next generation of secure, transparent TEE containers.

Acknowledgements.

Weijie Liu, Shuo Huai, and Zheli Liu are supported by the National Natural Science Foundation of China under Grant No.62502237, No.U25B2028, and No.62432012.

Appendix A Data availability

The availability, functionality, and reproducibility of our artifact are ensured. The source code is temporarily hosted on the website (code_release). We reported our findings to the relevant communities and vendors (Intel, Gramine, Occlum, Mystikos, and CoCo), who have confirmed the existence of the risks we discovered. The examples provided in the paper have already been fixed, mitigated, discussed, or made public by the developers.