Skip to content

Latest commit

 

History

History
150 lines (82 loc) · 6.91 KB

Summary.md

File metadata and controls

150 lines (82 loc) · 6.91 KB

Security Enhancement summary

Data Execution Protection

Image Protection

Technology: Set PE image code region to readonly, data region to be non-executable.

Status: Production

DXE controlled by: gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy in MdeModulePkg.dec, SMM enabled by default.

Non-Executable Memory protection

Technology: Set data region to be non-executable

Status: Production

DXE controlled by: gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy in MdeModulePkg.dec, SMM enabled by default.

NULL pointer detection

Technology: mark the first 4K page to be not present to detect NULL pointer dereference

Status: Production

Controlled by: gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask in MdeModulePkg.dec.

Address Space Layout Randomization

Image Shuffle

Technology: Shuffle the loaded image

Status: Prototype

ImageShuffle is configured by PcdImageShuffleEnable. DXE prototype is at DxeCore, SMM prototype is at PiSmmCore.

Data Buffer Shift

Technology: Shift the data buffer - heap and stack

Status: Prototype

Randomization is configured by PcdASLRMinimumEntropyBits, DXE prototype is at DxeCore and DxeIpl, SMM prototype is at PiSmmCore.

Buffer Overflow Detection

Stack Guard

Technology: Use guard page to detect global stack overflow.

Status: Production

DXE controlled by: gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard in MdeModulePkg.dec, SMM controlled by: gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard in UefiCpuPkg.dec.

Heap Guard

Technology: Use guard page to detect heap overflow.

Status: Debug

Controlled by: gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask in MdeModulePkg.dec, gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPageType in MdeModulePkg.dec, gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType in MdeModulePkg.dec.

Stack Canary

Technology: Use compiler to insert cookie to detect local stack overflow (need compiler support)

Status: Prototype

MSVC compiler stub (/GS) prototype is at GSStub.c, GCC/LLVM compiler stub (-fstack-protector-strong) prototype is at StackProtectorStub.c.

Address Sanitizer

Technology: Use compiler to insert redzone to detect buffer overflow (need compiler support)

Status: Prototype, Debug

MSVC compiler stub (/RTCs) prototype is at RTCsStub.c, LLVM compiler stub (-fsanitize=address) prototype is at ASanStub.c.

Misc Runtime Check

Undefined Behavior Sanitizer (Type Cast)

Technology: Use compiler to insert runtime check for undefined behavior such as type cast. (need compiler support)

Status: Prototype, Debug

MSVC compiler stub (/RTCc) prototype is at RTCcStub.c, LLVM compiler stub (-fsanitize=undefined) protype is at UBSanStub.c.

Memory Sanitizer (Uninitialized Access)

Technology: Use compiler to insert check to detect uninitialized data read. (need compiler support)

Status: Prototype, Debug

MSVC compiler stub (/RTCu) prototype is at RTCuStub.c, LLVM (-fsanitize=memory) cannot be enabled because it does not support windows platform yet.

Control Flow

Shadow Stack (Intel CET-SS)

Technology : return address protection to defend against Return Oriented Programming

Status: SMM production, DXE prototype

SMM shadow stack is controlled by gEfiMdePkgTokenSpaceGuid.PcdControlFlowEnforcementPropertyMask in MdePkg.c, DXE shadow stack prototype is at DxeCet.

Indirect Branch Tracking (Intel CET-IBT)

Technology : free branch protection to defend against Jump/Call Oriented Programming (need compiler support)

Status: Prototype

Prototype is at Ibt. The IBT cannot be enabled in MSVC, because the compiler does NOT support it yet.

Software Control Flow Integrity/Guard

Technology : Use compiler to insert control flow check to detect control flow attack (need compiler support)

Status: Prototype

MSVC compiler stub (/guard:cf) prototype is at CfgStub.c, LLVM compiler stub (-fsanitize=cfi) prototype is at CfiStub.c.

Reference

  1. A Tour Beyond BIOS - Security Enhancement to Mitigate Buffer Overflow in UEFI

  2. A Tour Beyond BIOS - Memory Map And Practices in UEFI BIOS

  3. SMM protection in EDKII

  4. CET-in-SMM