apache / apache/teaclave-sgx-sdk

*session_ptr and *pp_quote_config may be leaked if overwrites to

Open
#441 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.2k
Forks
268
PR merge metrics
No merged PRs in 30d

Description

https://github.com/apache/incubator-teaclave-sgx-sdk/blob/3c903bdac4e503dd27b9b1f761c4abfc55f2464c/samplecode/localattestation/attestation/src/func.rs#L144-L145
https://github.com/apache/incubator-teaclave-sgx-sdk/blob/3c903bdac4e503dd27b9b1f761c4abfc55f2464c/samplecode/dcap-pckretrieval/qpl/src/lib.rs#L138-L142

with `Box::into_raw()`, the pointee is on the heap. Multiple assignments will cause leak of the old value.

Probable fix is like:
If `session_request_safe` should only be called once, adding an Atomic to guarantee assigning only once.
```Rust
const UNINITIALIZED: usize = 0;
const INITIALIZING: usize = 1;
const INITIALIZED: usize = 2;
static GLOBAL_INIT: AtomicUsize = AtomicUsize::new(UNINITIALIZED);
pub struct SetGlobalDefaultError {
_no_construct: (),
}

// in `session_request_safe`
if GLOBAL_INIT
.compare_exchange(
UNINITIALIZED,
INITIALIZING,
Ordering::SeqCst,
Ordering::SeqCst,
)
.is_ok()
{
let ptr = Box::into_raw(Box::new(session_info));
*session_ptr = ptr as * mut _ as usize;
}
```
Otherwise add the else branch:
```Rust
else {
drop(Box::from_raw(*session_ptr));
let ptr = Box::into_raw(Box::new(session_info));
*session_ptr = ptr as * mut _ as usize;
}

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the assignments at samplecode/localattestation/attestation/src/func.rs#L144-L145 and samplecode/dcap-pckretrieval/qpl/src/lib.rs#L138-L142, focusing on the Box::into_raw calls and whether these functions may run more than once. Determine whether repeated initialization should be prevented or whether the previous allocation should be released. Done means repeated assignments no longer leak the old *session_ptr or *pp_quote_config value while preserving the intended initialization behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.