user_check protection for SGXSpectre

Elephant — Thu, 15 Mar 2018 09:57:38 GMT

Hi,

Intel has released a technical advisory about the fixes for Spectre. However, I would like to get more insight on how to handle user_check. So from the "Intel® Software Guard Extensions (SGX) SW Development Guidance for Potential Bounds Check Bypass (CVE-2017-5753) Side Channel Exploits" whitepaper, Intel mentioned that we have to protect user_check inputs with the following pattern:

uint32_t enclave_function(const uint8_t* user_check_input,
uint32_t user_check_size)
{
...
//
// make sure input buffer is outside enclave
//
int SGXAPI sgx_is_outside_enclave(const void *addr, size_t
size);
if (!sgx_is_outside_enclave(user_check_input,
user_check_size)) {
// error code
...
}
else {
_mm_lfence();
...
}
...
}

However, how do I protect the structure that I passed with user_check when it has multiple pointers inside?

Thanks!

Kind Regards,
Elephant

If the buffer is a structure

Hoang_N_Intel — Mon, 16 Apr 2018 18:22:13 GMT

If the buffer is a structure of multiple pointers to other buffers, you will probably have to add one call to sgx_is_outside_enclave per pointer before you reference it.

topic user_check protection for SGXSpectre in Intel® Software Guard Extensions (Intel® SGX)

user_check protection for SGXSpectre

If the buffer is a structure