Summary Signal’s Contact Discovery Service lets users learn which of their contacts use Signal without revealing their address book to the service. This is done by processing encrypted queries inside an attested Intel SGX enclave, keeping their contents out of reach of the server operator. We found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary. The first vulnerability gives the host an arbitrary enclave memory read. The second giv...