apache / apache/teaclave-sgx-sdk
*session_ptr and *pp_quote_config may be leaked if overwrites to
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 268
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/apache/incubator-teaclave-sgx-sdk/blob/3c903bdac4e503dd27b9b1f761c4abfc55f2464c/samplecode/localattestation/attestation/src/func.rs#L144-L145
https://github.com/apache/incubator-teaclave-sgx-sdk/blob/3c903bdac4e503dd27b9b1f761c4abfc55f2464c/samplecode/dcap-pckretrieval/qpl/src/lib.rs#L138-L142
with `Box::into_raw()`, the pointee is on the heap. Multiple assignments will cause leak of the old value.
Probable fix is like:
If `session_request_safe` should only be called once, adding an Atomic to guarantee assigning only once.
```Rust
const UNINITIALIZED: usize = 0;
const INITIALIZING: usize = 1;
const INITIALIZED: usize = 2;
static GLOBAL_INIT: AtomicUsize = AtomicUsize::new(UNINITIALIZED);
pub struct SetGlobalDefaultError {
_no_construct: (),
}
// in `session_request_safe`
if GLOBAL_INIT
.compare_exchange(
UNINITIALIZED,
INITIALIZING,
Ordering::SeqCst,
Ordering::SeqCst,
)
.is_ok()
{
let ptr = Box::into_raw(Box::new(session_info));
*session_ptr = ptr as * mut _ as usize;
}
```
Otherwise add the else branch:
```Rust
else {
drop(Box::from_raw(*session_ptr));
let ptr = Box::into_raw(Box::new(session_info));
*session_ptr = ptr as * mut _ as usize;
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the assignments at samplecode/localattestation/attestation/src/func.rs#L144-L145 and samplecode/dcap-pckretrieval/qpl/src/lib.rs#L138-L142, focusing on the Box::into_raw calls and whether these functions may run more than once. Determine whether repeated initialization should be prevented or whether the previous allocation should be released. Done means repeated assignments no longer leak the old *session_ptr or *pp_quote_config value while preserving the intended initialization behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100