Skip to content
Permalink
Browse files

core: clear the entire TA area

Previously we cleared (memset to zero) the size corresponding to code
and data segments, however the allocation for the TA is made on the
granularity of the memory pool, meaning that we did not clear all memory
and because of that we could potentially leak code and data of a
previous loaded TA.

Fixes: OP-TEE-2018-0006: "Potential disclosure of previously loaded TA
code and data"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
  • Loading branch information...
jbech-linaro authored and jforissier committed Sep 7, 2018
1 parent 5ee85d7 commit 7e768f8a473409215fe3fff8f6e31f8a3a0103c6
Showing with 6 additions and 2 deletions.
  1. +6 −2 core/arch/arm/kernel/user_ta.c
@@ -197,8 +197,12 @@ static struct mobj *alloc_ta_mem(size_t size)
#else
struct mobj *mobj = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);

if (mobj)
memset(mobj_get_va(mobj, 0), 0, size);
if (mobj) {
size_t granularity = BIT(tee_mm_sec_ddr.shift);

/* Round up to allocation granularity size */
memset(mobj_get_va(mobj, 0), 0, ROUNDUP(size, granularity));
}
return mobj;
#endif
}

0 comments on commit 7e768f8

Please sign in to comment.
You can’t perform that action at this time.