BUG写手

Bugs found

6

# Null Pointer Dereference (NPD) (70) In `ecall_OBJ_nid2sn`, invalid `n` fed to `OBJ_nid2sn` will cause NULL is returned to `str` (e.g. when `ecall_OBJ_create` is not called before), and then `strlen(str)`...

kafl debug can't step into shared library

6

Hello, I'm facing a problem when I want to debug crash input after fuzzing. I use follow command to start debug ``` kafl debug -w /home/leone/Documents/SGXSan/SGX_APP/sgx-wallet/workdir --kernel /boot/vmlinuz-5.10.73-kafl+ --initrd /home/leone/Documents/SGXSan/SGX_APP/sgx-wallet/sgx-wallet.cpio.gz...

pipe target output to hcat show nothing

2

Hello! In order to show some information in work_dir, `hprintf` in source code can always output string, however, if I use `./target 2>&1 | vmcall hcat` in shell script e.g....

Any documents to show how to use "kafl cov"?

3

Any documents to show how to use "kafl cov"?

Bugs found in ehsm

23

Hello~ # Heap OOB `enclave_decrypt` defined in EDL set `cmk_size` as `cmk`'s size, but attacker can feed `cmk_size` smaller then `sizeof(ehsm_keyblob_t)`, and TBridge only `malloc` `cmk_size` for it. ```c public...

Several Bugs

2

# UAF 1 If `ssl_conn_handle` called after `ssl_conn_teardown` by untrusted host https://github.com/bl4ck5un/mbedtls-SGX/blob/eab8e36a1e670a2fa66105735143eafa51931bff/example/enclave/ecalls.cpp#L44-L50 `this` is dangling, and `this->conf` at line 159 will cause UAF https://github.com/bl4ck5un/mbedtls-SGX/blob/eab8e36a1e670a2fa66105735143eafa51931bff/example/enclave/ssl_conn_hdlr.cpp#L151-L159 # UAF 2 If `ssl_conn_teardown` called...

Bugs found

1

In `seekAndRead`, `osRead` call `ocall_read`, and get `got` from host, but without proper check, and then it used in `memset` of `unixRead`, cause `&pBuf[got]` stack overflow ```cpp SQLITE_PRIVATE int sqlite3BtreeOpen(...)...

secretflow API编程有问题

15

下面是一段使用sf API的代码，运行有问题（在`sf.init`里加上`debug_mode=True`后直接卡住了） ```python import secretflow as sf import jax.numpy as jnp import numpy as np # from sklearn.datasets import load_iris from sklearn.svm import SVC from sklearn.model_selection import train_test_split from sklearn.metrics...

TEEU报错

3

按照[TEEU教程](https://www.secretflow.org.cn/zh-CN/docs/secretflow/v1.3.0b0/tutorial/teeu#id4)部署TEEU时，出现如下报错，这是什么问题 ```shell W0314 17:00:32.927152 2 external/com_github_brpc_brpc/src/bvar/default_variables.cpp:434] Fail to open /proc/self/io: No such file or directory W0314 17:00:32.944652 66 external/com_github_brpc_brpc/src/bvar/default_variables.cpp:214] Fail to open /proc/self/statm: No such file or directory W0314 17:00:32.944726...