TEE suppression plugin RPC copies full request buffer when actual output is smaller, leaking secure heap data

[Finder16]

fix bug

[jforissier]

Thanks for the patch. Please provide a proper commit subject and description.

[Finder16]

Copies only the smaller of the plugin’s reported output length (outlen) and the requested length into the core/user buffers, preventing leftover heap data from leaking when the response is shorter than len

[jforissier]

Copies only the smaller of the plugin’s reported output length (outlen) and the requested length into the core/user buffers, preventing leftover heap data from leaking when the response is shorter than len

Excellent. I'd like to see this in the git commit description.

[Finder16]

done

[jforissier]

One more thing, we also require authors to provide a Signed-off-by. Please see: https://optee.readthedocs.io/en/latest/general/contribute.html

[Finder16]

Is this the correct way to do it?

[jforissier]

Is this the correct way to do it?

Please run:

git config user.name "Jaeyeong Lee"
git config user.email "[email protected]"
git commit --amend -s --reset-author

This will set the Git Author field properly and in addition it will append a Signed-off-by: tag.

[Finder16]

done

[jenswi-linaro]

Copies only the smaller of the plugin’s reported output length (outlen)
and the requested length. This prevents leaking leftover secure-world
heap data when the plugin returns fewer bytes than the caller requested.

Previously, tee_invoke_supp_plugin_rpc() copied len bytes regardless of
the actual number of bytes produced by the plugin, resulting in kernel /
secure heap disclosure into the REE.

I don't see how kernel or secure heap is leaked. This copies from shared memory allocated by the tee-supplicant. Unless I've misunderstood it, the worst case is leaking tee-supplicant heap.

[jenswi-linaro]

size_t resp_len = MIN(*outlen, len);

[github-actions]

This pull request has been marked as a stale pull request because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this pull request will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.