diff options
| author | Raoul Strackx <raoul.strackx@fortanix.com> | 2020-06-17 18:07:12 +0200 |
|---|---|---|
| committer | Raoul Strackx <raoul.strackx@fortanix.com> | 2020-06-18 12:11:39 +0200 |
| commit | daedb7920f48941bd8ffa1b1463b417b1641c823 (patch) | |
| tree | a7e3319a001b114e67fba0148eacd5ea671886e1 | |
| parent | e55d3f9c5213fe1a25366450127bdff67ad1eca2 (diff) | |
| download | rust-daedb7920f48941bd8ffa1b1463b417b1641c823.tar.gz rust-daedb7920f48941bd8ffa1b1463b417b1641c823.zip | |
Prevent attacker from manipulating FPU tag word used in SGX enclave
Insufficient sanitization of the x87 FPU tag word in the trusted enclave runtime allowed unprivileged adversaries in the containing host application to induce incoherent or unexpected results for ABI-compliant compiled enclave application code that uses the x87 FPU. Vulnerability was disclosed to us by Fritz Alder, Jo Van Bulck, David Oswald and Frank Piessens
| -rw-r--r-- | src/libstd/sys/sgx/abi/entry.S | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/libstd/sys/sgx/abi/entry.S b/src/libstd/sys/sgx/abi/entry.S index 2badfc973c9..0c3afa77a60 100644 --- a/src/libstd/sys/sgx/abi/entry.S +++ b/src/libstd/sys/sgx/abi/entry.S @@ -177,6 +177,13 @@ sgx_entry: jz .Lskip_debug_init mov %r10,%gs:tcsls_debug_panic_buf_ptr .Lskip_debug_init: +/* reset cpu state */ + mov %rdx, %r10 + mov $-1, %rax + mov $-1, %rdx + xrstor .Lxsave_clear(%rip) + mov %r10, %rdx + /* check if returning from usercall */ mov %gs:tcsls_last_rsp,%r11 test %r11,%r11 |