René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Bugs found in ehsm","articleBody":"Hello~\r\n\r\n# Heap OOB\r\n`enclave_decrypt` defined in EDL set `cmk_size` as `cmk`'s size, but attacker can feed `cmk_size` smaller then `sizeof(ehsm_keyblob_t)`, and TBridge only `malloc` `cmk_size` for it.\r\n```c\r\npublic sgx_status_t enclave_decrypt([in, size=cmk_size] ehsm_keyblob_t* cmk, size_t cmk_size,\r\n                            [in, size=aad_size] ehsm_data_t *aad, size_t aad_size,\r\n                            [in, size=ciphertext_size] ehsm_data_t *ciphertext, size_t ciphertext_size,\r\n                            [in, out, size=plaintext_size] ehsm_data_t *plaintext, size_t plaintext_size);\r\n```\r\nThen in function `enclave_decrypt`, `cmk-\u003ekeybloblen` will out-of-bound access invalid memory, e.g. `cmk-\u003ekeybloblen` is at offset 0x30, but `cmk_size` is fed with 0x20.\r\n\r\n```\r\nsgx_status_t enclave_decrypt(ehsm_keyblob_t *cmk, size_t cmk_size,\r\n                             ehsm_data_t *aad, size_t aad_size,\r\n                             ehsm_data_t *ciphertext, size_t ciphertext_size,\r\n                             ehsm_data_t *plaintext, size_t plaintext_size)\r\n{\r\n    sgx_status_t ret = SGX_ERROR_UNEXPECTED;\r\n\r\n    if (cmk == NULL ||\r\n        cmk_size != APPEND_SIZE_TO_KEYBLOB_T(cmk-\u003ekeybloblen) ||\r\n        cmk-\u003ekeybloblen == 0 ||\r\n        cmk-\u003emetadata.origin != EH_INTERNAL_KEY)\r\n        return SGX_ERROR_INVALID_PARAMETER;\r\n    ...\r\n}\r\n```","author":{"url":"https://github.com/LeoneChen","@type":"Person","name":"LeoneChen"},"datePublished":"2023-06-01T18:09:56.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":23},"url":"https://github.com/265/ehsm/issues/265"}