Skip to content

jmp0x7c00/STELLA

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

39 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

STELLA

Mind Your Enclave Pointers! Detecting Privacy Leakage for SGX Applications via Sparse Taint Analysis


Our paper is the first to reveal a pointer misuse problem in SGX software that leads to privacy leakage, and we summarize five pointer-misuse patterns:

  • write private data to OCALL out pointers
  • write private data to OCALL in pointers
  • write private data to ECALL user_check pointers
  • write private data to OCALL return pointers
  • write private data to Null pointers

We have implemented a prototype to detect enclave leakage bugs related to these patterns.

Architecture

image

Requirements

Our prototype is built for following system:

  • Ubuntu 20.04 LTS
  • Intel i7-9700T 4.30GHz 8-core CPU and 32G memory
  • Intel SGX SDK 2.15
  • LLVM/Clang v13
  • SVF

Note: A real SGX-enable CPU is optional.

Source Code

STELLA
|
|-- src
      |-- core
             |-- ELA.cpp
      |
      |-- edl_extractor
                      |- Extractor.ml
                      |- CodeGen.ml
      |
      |-- llvm_src
      |
      |-- svf_src
|
|-- PoCs
       |-- ECALL_out_leak
       |
       |-- ECALL_user_check_leak
       |
       |-- Null_pointer_leak
       |
       |-- OCALL_in_leak
       |
       |-- OCALL_return_leak
|
|-- scripts
          |-- PoCs
          |
          |-- real-world enclaves

Build

export PROJECT_ROOT=path_to_repository_head

Install Intel SGX SDK

Installation guide

Build LLVM Toolchain

  1. Install required libraries
sudo apt-get install linux-headers-$(uname -r) csh gawk automake libtool bison flex libncurses5-dev
# Check 'makeinfo -v'. If 'makeinfo' does not exist
sudo apt-get install apt-file texinfo texi2html
sudo apt-file update
sudo apt-file search makeinfo
  1. Download binutils source code
cd ~
git clone --depth 1 git://sourceware.org/git/binutils-gdb.git binutils
  1. Build binutils
mkdir build
cd build
../binutils/configure --enable-gold --enable-plugins --disable-werror
make
  1. Build LLVM
cd $PROJECT_ROOT/src
wget https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-13.0.0.zip
unzip llvmorg-13.0.0.zip
mv llvmorg-13.0.0 llvm_src
cd llvm_src
mkdir build
cd build
# replace path_to_binutils to the actual path.
cmake -DLLVM_ENABLE_PROJECTS=clang -DLLVM_BINUTILS_INCDIR="path_to_binutils/include" -G "Unix Makefiles" ../llvm
make -j8
  1. Backup ar, nm, ld and ranlib:
cd ~
mkdir backup
cd /usr/bin/
cp ar ~/backup/
cp nm ~/backup/
cp ld ~/backup/
cp ranlib ~/backup/
  1. Replace ar, nm, ld and ranlib
cd /usr/bin/
sudo cp ~/build/binutils/ar ./
sudo rm nm
sudo cp ~/build/binutils/nm-new ./nm
sudo cp ~/build/binutils/ranlib ./
sudo cp ~/build/gold/ld-new ./ld
  1. Install gold plugin
cd /usr/lib
sudo mkdir bfd-plugins
cd bfd-plugins
sudo cp $PROJECT_ROOT/src/llvm_src/build/lib/LLVMgold.so ./
sudo cp $PROJECT_ROOT/src/llvm_src/build/lib/libLTO.* ./

Build SVF

sudo apt install cmake gcc g++ libtinfo-dev libz-dev zip wget ##(If running on Ubuntu 20.04)
cd $PROJECT_ROOT/src/svf_src
source ./build.sh

Build Core

cd $PROJECT_ROOT/src/core_src
mkdir build
cd build
make ..

Usage

Run STELLA on PoCs:

cd $PROJECT_ROOT/scripts/PoCs
./run.sh

Run STELLA on real-world enclaves:

cd $PROJECT_ROOT/scripts/real-world enclaves/BiORAM-SGX
./run.sh

Experimental Results

  • Currently, 21 bugs are confirmed and 4 bugs are fixed.
Index Project Leak Type Leak Point Leaked Variable Status
1 sgx-aes-gcm ECALL out Source Location Source Location Reported
2 sgx-aes-gcm OCALL in Source Location Source Location Reported
3 sgx-based-mix-networks ECALL out Source Location Source Location Reported
4 sgx-based-mix-networks NPD Source Location Source Location Reported
5 sgx_wechat_app OCALL in Source Location Source Location Reported
6 TACIoT OCALL in Source Location Source Location Fixed
7 password-manager OCALL in Source Location Source Location Reported
8 password-manager NPD Source Location Source Location Reported
9 BiORAM-SGX OCALL in Source Location Source Location Reported
10 BiORAM-SGX OCALL in Source Location Source Location Reported
11 Town-Crier OCALL in Source Location Source Location Confirmed
12 Town-Crier OCALL in Source Location Source Location Confirmed
13 Town-Crier NPD Source Location Source Location Confirmed
14 Town-Crier NPD Source Location Source Location Reported
15 Town-Crier NPD Source Location Source Location Confirmed
16 Town-Crier NPD Source Location Source Location Confirmed
17 Town-Crier NPD Source Location Source Location Confirmed
18 Town-Crier NPD Source Location Source Location Confirmed
19 Town-Crier NPD Source Location Source Location Confirmed
20 Town-Crier NPD Source Location Source Location Confirmed
21 Town-Crier NPD Source Location Source Location Confirmed
22 Town-Crier NPD Source Location Source Location Confirmed
23 Town-Crier NPD Source Location Source Location Confirmed
24 Town-Crier NPD Source Location Source Location Reported
25 Fidelius OCALL in Source Location Source Location Reported
26 Fidelius NPD Source Location Source Location Reported
27 Fidelius NPD Source Location Source Location Reported
28 Fidelius NPD Source Location Source Location Reported
29 Fidelius NPD Source Location Source Location Reported
30 Fidelius NPD Source Location Source Location Reported
31 sgx-dnet OCALL in Source Location Source Location Reported
32 sgx-dnet NPD Source Location Source Location Reported
33 sgx-dnet NPD Source Location Source Location Reported
34 sgx-dnet NPD Source Location Source Location Reported
35 sgx-dnet NPD Source Location Source Location Reported
36 sgx-dnet NPD Source Location Source Location Reported
37 sgx-dnet NPD Source Location Source Location Reported
38 sgx-dnet NPD Source Location Source Location Reported
39 sgx-dnet NPD Source Location Source Location Reported
40 sgx-dnet NPD Source Location Source Location Reported
41 sgx-dnet NPD Source Location Source Location Reported
42 sgx-dnet NPD Source Location Source Location Reported
43 sgx-dnet NPD Source Location Source Location Reported
44 sgx-dnet NPD Source Location Source Location Reported
45 sgx-dnet NPD Source Location Source Location Reported
46 sgx-dnet NPD Source Location Source Location Reported
47 sgx-dnet NPD Source Location Source Location Reported
48 sgx-dnet NPD Source Location Source Location Reported
49 sgx-dnet NPD Source Location Source Location Reported
50 sgx-dnet NPD Source Location Source Location Reported
51 sgx-dnet NPD Source Location Source Location Reported
52 sgx-dnet NPD Source Location Source Location Reported
53 sgx-dnet NPD Source Location Source Location Reported
54 sgx-dnet NPD Source Location Source Location Reported
55 sgx-dnet NPD Source Location Source Location Reported
56 sgx-dnet NPD Source Location Source Locatoin Reported
57 PrivacyGuard OCALL in Source Location Source Location Confirmed
58 PrivacyGuard OCALL in Source Location Source Location Fixed
59 PrivacyGuard OCALL in Source Location Source Location Fixed
60 PrivacyGuard OCALL in Source Location Source Location Fixed
61 PrivacyGuard NPD Source Location Source Location Confirmed
62 PrivacyGuard NPD Source Location Source Location Confirmed
63 PrivacyGuard NPD Source Location Source Location Confirmed
64 PrivacyGuard NPD Source Location Source Location Confirmed
65 PrivacyGuard NPD Source Location Source Location Confirmed
66 PrivacyGuard NPD Source Location Source Location Confirmed
67 PrivacyGuard NPD Source Location Source Location Confirmed
68 SGX_SQLite OCALL in line 30540 in sqlit.c line 30539 in sqlit.c Reported
69 TaLoS ECALL user_check Source Location Source Location Confirmed
70 TaLoS ECALL user_check Source Location Source Location Reported
71 TaLoS ECALL out Source Location Source Location Reported
72 SGX-Tor OCALL return Source Location Source Location Reported
73 SGX-Tor OCALL in Source Location Source Location Reported
74 SGX-Tor NPD Source Location Source Location Reported
75 SGX-Tor NPD Source Location Source Location Reported
76 SGX-Tor NPD Source Location Source Location Reported
77 SGX-Tor NPD Source Location Source Location Reported
78 SGX-Tor NPD Source Location Source Location Reported
79 SGX-Tor NPD Source Location Source Location Reported
80 SGX-Tor NPD Source Location Source Location Reported

Screenshots

About

STELLA source code and exprimental results

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published