TaintSGX: Global ICFG modeling and taint analysis for SGX application

The Intel SGX framework can provide integrity and confidentiality guarantees for SGX applications against attacks from malicious privileged software. However, due to programming errors or malicious code, a SGX application may have defects or leak sensitive user data. Static analysis is an effective way to detect privacy leaks and bugs in software. However, performing precise static analysis for SGX applications is challenging because the data-flow and control-flow dependency between the trusted and untrusted parts are missing due to the opaque realization in Intel SGX framework. Furthermore, for taint analysis, the automatic and precise identification of taint sources and sinks for a SGX application is also hard. In this work, we propose TaintSGX, a general static analysis framework supporting privacy leak detection on SGX applications. TaintSGX proposes to build a general global Inter-procedural Control Flow Graph model for the whole SGX application, and it handles the data-flow breakpoints and defines the core elements (sources, sinks, and propagation policies) for taint analysis. Our evaluation on 32 popular open-source SGX applications shows TaintSGX can precisely and effectively detect 52 direct privacy leaks and 356 control flow related privacy leaks with high efficiency. © 2026 Elsevier Inc.