Azure Attestation SDK incompatible with VBS STRICT_MEMORY --- confirmed native memory access violation

Lutz Engelland 0 Reputation points
2026-11-09T15:57:04.17+00:00

We have isolated a reproducible incompatibility in Microsoft.Attestation.Client 1.1.133870390-preview.

In two otherwise identical signed VBS enclaves:

STRICT_MEMORY enabled: att_create_session returns 0x80010018.

STRICT_MEMORY disabled: att_create_session returns ATT_OK (0x00010000).

The failure originates in AzureAttest.dll at RVA 0x797BD (mov rcx, qword ptr [rdx]), which directly reads host memory.

Copying the input into enclave memory does not resolve the issue: the SDK rejects the internal pointer with 0x80010009.

We have a minimal native C++ reproducer and A/B test logs.

Question: Is there a supported Microsoft Attestation SDK version compatible with VBS IMAGE_ENCLAVE_POLICY_STRICT_MEMORY, or a supported alternative integration path?

Disabling STRICT_MEMORY is not acceptable for our production security requirements.

Could a Microsoft Azure Attestation engineer confirm whether this is a known limitation and advise on a supported solution?

We can provide a minimal C++ reproducer and sanitized A/B test logs upon request.

Thank you.

Best, Lutz Engelland

Windows development | Windows API - Win32
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.