general/occlum
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[libos] Fix vulnerable nonce in DCAP verifier

Browse Source 
This commit fixed a security issue in the dcap verifier. The issue was caused by the '[in, out]' attributes of pointer parameter qve_report_info in the ocall function occlum_ocall_verify_dcap_quote(). This led to the vulnerability where the protected qve_report_info.nonce field in libos could be arbitrarily rewritten by attacker outside libos.

Signed-off-by: Kun Lai <me@imlk.top>
This commit is contained in:
Kun Lai 2023-01-13 11:00:50 +00:00 committed by volcano
parent a6458eb662
commit 12cb488f36
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/libos/src/util/sgx/dcap/quote_verifier.rs
View File

@ -39,6 +39,7 @@ impl QuoteVerifier {
let mut collateral_expiration_status = 1; let mut collateral_expiration_status = 1;
let mut supplemental_data = vec![0; self.supplemental_data_size as usize]; let mut supplemental_data = vec![0; self.supplemental_data_size as usize];
let mut qve_report_info = sgx_ql_qe_report_info_t::default(); let mut qve_report_info = sgx_ql_qe_report_info_t::default();
let mut nonce;
unsafe { unsafe {
let sgx_status = sgx_read_rand( let sgx_status = sgx_read_rand(
@ -48,6 +49,7 @@ impl QuoteVerifier {
if sgx_status != sgx_status_t::SGX_SUCCESS { if sgx_status != sgx_status_t::SGX_SUCCESS {
return_errno!(EAGAIN, "failed to get random number from sgx"); return_errno!(EAGAIN, "failed to get random number from sgx");
} }
nonce = qve_report_info.nonce;
} }
qve_report_info.app_enclave_target_info = get_self_target()?; qve_report_info.app_enclave_target_info = get_self_target()?;
@ -66,6 +68,9 @@ impl QuoteVerifier {
supplemental_data.as_mut_ptr(), supplemental_data.as_mut_ptr(),
); );
assert_eq!(sgx_status_t::SGX_SUCCESS, sgx_status); assert_eq!(sgx_status_t::SGX_SUCCESS, sgx_status);
// We have to re-write qve_report_info.nonce with the value we backed up earlier,
// since qve_report_info.nonce can be overwrite by attacker from ocall side.
qve_report_info.nonce = nonce;
} }
match qe3_ret { match qe3_ret {