intel / intel/confidential-computing.sgx.sdk

libsgx_enclave_common: enclave_load_data doesn't configure page tables correctly

Open
#18 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

`enclave_load_data` will call `mprotect` to match the PT permissions to the EPCM permissions. Unfortunately, when calling `mprotect` with `PROT_NONE`, Linux will completely remove the page table mapping instead of mapping it without permissions. This is a problem for TCS pages which don't require any EPCM permissions.

Suggested resolution: protect such pages with `PROT_READ` instead.

Alternatively, since the PT permissions don't really matter, and because calling `mprotect` with different permissions will split up the VMAs in the kernel, just map everything RWX.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.