intel / intel/confidential-computing.sgx.sdk
segmentation fault inside secure enclave
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
hello! I faced with an issue that passing random input to ecall may cause segmentation fault on version 2.13. after debugging with `sgx_gdb` I figured out that most probably it is related to not enough checks in automatically generated code by Intel: all generated checks for input pointers are passed(`secure_encalve_t.c` file) and call to secure enclave function ends well (all data is well-formed and valid after executing the function) but while copying from temporary buffer to resultant buffer (it is still the part of automatically generated code in `secure_enclave_t.c`) I always get a segmentation fault inside `memcpy_s`. attaching the files with automatically generated code, input, part of edl file and gdb log to the issue. I do calls to the enclave with `sgx_ecall(global_eid, ecall_idx, 0, (void*) input);` happens on ubuntu 18.04 and gcc-7.5. waiting for your reply and thanks in advance!
[gdb_log.txt](https://github.com/intel/linux-sgx/files/7136790/gdb_log.txt)
[secure_enclave_edl.txt](https://github.com/intel/linux-sgx/files/7136780/secure_enclave_edl.txt)
[input.txt](https://github.com/intel/linux-sgx/files/7136784/input.txt)
[secure_enclave_t_c.txt](https://github.com/intel/linux-sgx/files/7136785/secure_enclave_t_c.txt)
Contributor guide
Research direction
Start with secure_enclave_edl.txt and the generated secure_enclave_t_c.txt, then use input.txt and gdb_log.txt to reproduce the failure under sgx_gdb. Trace the memcpy_s call after the enclave function returns and verify that the reported random-input ecall no longer causes a segmentation fault.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100