intel / intel/confidential-computing.sgx.sdk
possible memory access violations
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
The latest SonarQue-Check for our project using SGX decteced again some issues in the Code of Local Attestation sample which we have adapted for our project.
The findings are not in the adapted code but in the original sample code.
Attached you can see 4 (out of 12 similar) findings where buffer overflows will occur or buffers are accessed outside their boundaries.
Would you please immediately check this out and request a solution at the development team?
Today I checked the issues against the current linux sgx github in
https://github.com/intel/linux-sgx/blob/master/SampleCode/LocalAttestation/EnclaveResponder/Utility_E2.cpp
and they are not fixed yet.
When will they be fixed?
[20210407_BufferOverflows.docx](https://github.com/intel/linux-sgx/files/6303176/20210407_BufferOverflows.docx)
Contributor guide
Research direction
Start with SampleCode/LocalAttestation/EnclaveResponder/Utility_E2.cpp and compare the reported findings in 20210407_BufferOverflows.docx with the current code. Review each of the four shown and similar buffer-boundary findings, then verify that the reported violations no longer occur.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100