On Mon, Oct 03, 2022 at 07:19:21PM +0200, Borys wrote: > Hi, > > I've stumbled upon "sgx_validate_offset_length" function in > "arch/x86/kernel/cpu/sgx/ioctl.c" (all of this is based on 6.0-rc7 > version), which does not entirely do what it claims. "offset" and > "length" parameters are provided by userspace and as such their addition > can overflow, which may result in this function approving malicious > values. Fortunately this does not result in any exploitable bugs at the > moment (or at least I couldn't find any), but this might change if > "sgx_validate_offset_length" is used in a new context or current usages > are changed, so it might be worth fixing anyway. Simple overflow check > `offset + length < offset` should be enough. > > Best regards, > > Borys > I agree with the bug but not on security issue. If you can call the ioctl API in the first place, you can already apply the operations in arbitrary locations inside the enclave, i.e. it does not introduce any new capability to the untrusted runtime. BR, Jarkko
