tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg: introduce UEFI freed-memory guard bit in HeapGuard PCD 

UAF (Use-After-Free) memory issue is kind of illegal access to memory
which has been freed. It can be detected by a new freed-memory guard
enforced onto freed memory.

BIT4 of following PCD is used to enable the freed-memory guard feature.

  gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask

Please note this feature is for debug purpose and should not be enabled
in product BIOS, and cannot be enabled with pool/page heap guard at the
same time. It's disabled by default.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
Jian J Wang 2018-10-24 10:26:07 +08:00
parent a6bde8a644
commit 5323e918c3
2 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
MdeModulePkg/MdeModulePkg.dec
View File

@ -1011,14 +1011,22 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType|0x0|UINT64|0x30001053 gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType|0x0|UINT64|0x30001053
## This mask is to control Heap Guard behavior. ## This mask is to control Heap Guard behavior.
# Note that due to the limit of pool memory implementation and the alignment #
# requirement of UEFI spec, BIT7 is a try-best setting which cannot guarantee # Note:
# that the returned pool is exactly adjacent to head guard page or tail guard # a) Heap Guard is for debug purpose and should not be enabled in product
# page. # BIOS.
# b) Due to the limit of pool memory implementation and the alignment
# requirement of UEFI spec, BIT7 is a try-best setting which cannot
# guarantee that the returned pool is exactly adjacent to head guard
# page or tail guard page.
# c) UEFI freed-memory guard and UEFI pool/page guard cannot be enabled
# at the same time.
#
# BIT0 - Enable UEFI page guard.<BR> # BIT0 - Enable UEFI page guard.<BR>
# BIT1 - Enable UEFI pool guard.<BR> # BIT1 - Enable UEFI pool guard.<BR>
# BIT2 - Enable SMM page guard.<BR> # BIT2 - Enable SMM page guard.<BR>
# BIT3 - Enable SMM pool guard.<BR> # BIT3 - Enable SMM pool guard.<BR>
# BIT4 - Enable UEFI freed-memory guard (Use-After-Free memory detection).<BR>
# BIT6 - Enable non-stop mode.<BR> # BIT6 - Enable non-stop mode.<BR>
# BIT7 - The direction of Guard Page for Pool Guard. # BIT7 - The direction of Guard Page for Pool Guard.
# 0 - The returned pool is near the tail guard page.<BR> # 0 - The returned pool is near the tail guard page.<BR>

14
MdeModulePkg/MdeModulePkg.uni
View File

@ -1224,14 +1224,20 @@
#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdHeapGuardPropertyMask_PROMPT #language en-US "The Heap Guard feature mask" #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdHeapGuardPropertyMask_PROMPT #language en-US "The Heap Guard feature mask"
#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdHeapGuardPropertyMask_HELP #language en-US "This mask is to control Heap Guard behavior.\n" #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdHeapGuardPropertyMask_HELP #language en-US "This mask is to control Heap Guard behavior.\n"
"Note that due to the limit of pool memory implementation and the alignment\n" " Note:\n"
"requirement of UEFI spec, BIT7 is a try-best setting which cannot guarantee\n" " a) Heap Guard is for debug purpose and should not be enabled in product"
"that the returned pool is exactly adjacent to head guard page or tail guard\n" " BIOS.\n"
"page.\n" " b) Due to the limit of pool memory implementation and the alignment"
" requirement of UEFI spec, BIT7 is a try-best setting which cannot"
" guarantee that the returned pool is exactly adjacent to head guard"
" page or tail guard page.\n"
" c) UEFI freed-memory guard and UEFI pool/page guard cannot be enabled"
" at the same time.\n"
" BIT0 - Enable UEFI page guard.<BR>\n" " BIT0 - Enable UEFI page guard.<BR>\n"
" BIT1 - Enable UEFI pool guard.<BR>\n" " BIT1 - Enable UEFI pool guard.<BR>\n"
" BIT2 - Enable SMM page guard.<BR>\n" " BIT2 - Enable SMM page guard.<BR>\n"
" BIT3 - Enable SMM pool guard.<BR>\n" " BIT3 - Enable SMM pool guard.<BR>\n"
" BIT4 - Enable UEFI freed-memory guard (Use-After-Free memory detection).<BR>\n"
" BIT7 - The direction of Guard Page for Pool Guard.\n" " BIT7 - The direction of Guard Page for Pool Guard.\n"
" 0 - The returned pool is near the tail guard page.<BR>\n" " 0 - The returned pool is near the tail guard page.<BR>\n"
" 1 - The returned pool is near the head guard page.<BR>" " 1 - The returned pool is near the head guard page.<BR>"