Comments (5)
Hello
Thank you for raising this issue. Indeed some additional checks could be implemented to check the provenance of the pointers passed with [user_check]
.
from talos.
Hi everyone, Hi @plaublin,
I am an academic security researcher at University of Duisburg-Essen, working with (@ldavi and @Tcc100). During our research on SGX we also discovered the security issues mentioned in this issue. However, we took it one step further and constructed a proof-of-concept exploit that achieves arbitrary code execution inside of the TaLoS SGX enclave, effectively bypassing any protections offered by SGX.
Indeed some additional checks could be implemented to check the provenance of the pointers passed with
[user_check]
.
It is not easy to add sufficient checks to pointers passed with [user_check]
. For example, a check for inside/outside enclave memory can often be bypassed by an attacker.
In our experience the best way to fix this is to avoid passing pointers to enclave memory at all and otherwise rely on the SGX SDK provided [in, out]
attributes.
Our suggestion is to replace pointers to enclave memory with simple integer identifiers, which are then translated into pointers using e.g., a hashmap or array lookup at the start of the ECALLs.
If you prefer I can contact you privately (e.g., via E-Mail) for details on our exploit and our recommendations on how to fix this issue.
from talos.
Hello
This is interesting. Would you have any reference to your proof of concept?
Replacing pointers with integer identifiers is what the shadow structures mechanism is doing: https://www.doc.ic.ac.uk/research/technicalreports/2017/DTRS17-5.pdf . We have used it for the SSL structure primarily, but it can be generalized to all of them.
Unfortunately I lack resources to quickly fix the issue... If you would happen to have pull requests I would be immensely grateful.
from talos.
Hi @plaublin, I'd rather discuss this privately. Can you contact me via email at michael.rodler (at) uni-due.de?
from talos.
For sake of completeness and since this probably won't get fixed any time soon, we published our PoC exploits (three variants) against this project: uni-due-syssec/teerex-exploits. Maybe this helps someone out there to create a pull request with fixes.
from talos.
Related Issues (20)
- Enclave once created is never destroyed HOT 1
- Build Nginx Successfully, but got a segmentation fault HOT 5
- potential security issue: ecall_SSL_write using [user_check] HOT 3
- SSL/TLS Client example
- memcpy warning when compiling TaLoS HOT 2
- potential security issue: ecall_SSL_read using [user_check] HOT 2
- Cannot find -lsgx_tstdcxx HOT 8
- What's the purpose of the code in /src/talso/enclaveshim HOT 5
- Deprecated function is not defined HOT 1
- Data races
- Unable to establish SSL connection when testing on the lastes version
- Dockerbuild will not start HOT 1
- Compilation of libressl not working HOT 5
- New Networking Library Drop-in Usage? HOT 2
- can not build TaLoS using clang,need help HOT 6
- The private key may be leaked to the attacker HOT 5
- verify_mode maybe be modified by the attacker HOT 1
- SSL session is leaked
- Bugs found HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from talos.