intel / intel/confidential-computing.sgx.sdk

possible memory access violations

Open
#88 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

The latest SonarQue-Check for our project using SGX decteced again some issues in the Code of Local Attestation sample which we have adapted for our project.
The findings are not in the adapted code but in the original sample code.

Attached you can see 4 (out of 12 similar) findings where buffer overflows will occur or buffers are accessed outside their boundaries.
Would you please immediately check this out and request a solution at the development team?

Today I checked the issues against the current linux sgx github in
https://github.com/intel/linux-sgx/blob/master/SampleCode/LocalAttestation/EnclaveResponder/Utility_E2.cpp
and they are not fixed yet.

When will they be fixed?

[20210407_BufferOverflows.docx](https://github.com/intel/linux-sgx/files/6303176/20210407_BufferOverflows.docx)

Contributor guide

Open the contributing guide

Research direction

Start with SampleCode/LocalAttestation/EnclaveResponder/Utility_E2.cpp and compare the reported findings in 20210407_BufferOverflows.docx with the current code. Review each of the four shown and similar buffer-boundary findings, then verify that the reported violations no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.