intel / intel/confidential-computing.sgx.sdk
libsgx_enclave_common: enclave_load_data doesn't configure page tables correctly
Open
bug
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
`enclave_load_data` will call `mprotect` to match the PT permissions to the EPCM permissions. Unfortunately, when calling `mprotect` with `PROT_NONE`, Linux will completely remove the page table mapping instead of mapping it without permissions. This is a problem for TCS pages which don't require any EPCM permissions.
Suggested resolution: protect such pages with `PROT_READ` instead.
Alternatively, since the PT permissions don't really matter, and because calling `mprotect` with different permissions will split up the VMAs in the kernel, just map everything RWX.
Contributor guide
Assessment
This issue has not been assessed yet.