diff options
| author | Ralf Jung <post@ralfj.de> | 2020-06-20 16:39:57 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-06-20 16:39:57 +0200 |
| commit | 96b86ea1a8989352798e6145fbb7c150470bc5c0 (patch) | |
| tree | dcb813067116788e4bfed678e0ab72fdc421b76e /src/libstd/sys | |
| parent | 7930ee68746249238ecaa846ebfa2bcdc97b1da7 (diff) | |
| parent | 33b304c5e0a620350e0eba0ceda2aab23f3b4e6f (diff) | |
| download | rust-96b86ea1a8989352798e6145fbb7c150470bc5c0.tar.gz rust-96b86ea1a8989352798e6145fbb7c150470bc5c0.zip | |
Rollup merge of #73471 - raoulstrackx:raoul/fpu_tag_word, r=jethrogb
Prevent attacker from manipulating FPU tag word used in SGX enclave Insufficient sanitization of the x87 FPU tag word in the trusted enclave runtime allowed unprivileged adversaries in the containing host application to induce incoherent or unexpected results for ABI-compliant compiled enclave application code that uses the x87 FPU. Vulnerability was disclosed to us by Fritz Alder, Jo Van Bulck, David Oswald and Frank Piessens cc: @jethrogb
Diffstat (limited to 'src/libstd/sys')
| -rw-r--r-- | src/libstd/sys/sgx/abi/entry.S | 20 |
1 files changed, 8 insertions, 12 deletions
diff --git a/src/libstd/sys/sgx/abi/entry.S b/src/libstd/sys/sgx/abi/entry.S index 2badfc973c9..fc6ce577033 100644 --- a/src/libstd/sys/sgx/abi/entry.S +++ b/src/libstd/sys/sgx/abi/entry.S @@ -26,18 +26,10 @@ IMAGE_BASE: .Lxsave_clear: .org .+24 .Lxsave_mxcsr: - .int 0 + .short 0x1f80 /* We can store a bunch of data in the gap between MXCSR and the XSAVE header */ -/* MXCSR initialization value for ABI */ -.Lmxcsr_init: - .int 0x1f80 - -/* x87 FPU control word initialization value for ABI */ -.Lfpucw_init: - .int 0x037f - /* The following symbols point at read-only data that will be filled in by the */ /* post-linker. */ @@ -177,13 +169,17 @@ sgx_entry: jz .Lskip_debug_init mov %r10,%gs:tcsls_debug_panic_buf_ptr .Lskip_debug_init: +/* reset cpu state */ + mov %rdx, %r10 + mov $-1, %rax + mov $-1, %rdx + xrstor .Lxsave_clear(%rip) + mov %r10, %rdx + /* check if returning from usercall */ mov %gs:tcsls_last_rsp,%r11 test %r11,%r11 jnz .Lusercall_ret -/* reset user state */ - ldmxcsr .Lmxcsr_init(%rip) - fldcw .Lfpucw_init(%rip) /* setup stack */ mov %gs:tcsls_tos,%rsp /* initially, RSP is not set to the correct value */ /* here. This is fixed below under "adjust stack". */ |