From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id B8D17D8006B for ; Tue, 18 Jul 2023 02:45:25 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=yyWupm6hbq+ZhQ6332mUzPmvi9+csSA1Z8ZWhBfRKEo=; c=relaxed/simple; d=groups.io; h=X-Received:X-Received:X-Received:X-Gm-Message-State:X-Google-Smtp-Source:X-Received:X-Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:Cc:References:From:In-Reply-To:Precedence:List-Unsubscribe:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1689648324; v=1; b=jNG7iuFnb2Pymq8jBW4jT9flPGEcgPjA1laQookc394LbreincgUIz5YlOOJvWpHNR7fnmj+ 2rwLHI3JA6b6OioUhAr392L3zJpsxbdik92brSvp4PVFOAm0BbmNKIVAQsck1MqulWAX/tuKT4a 7O8eV5PfNnVQhXBul2pfemFM= X-Received: by 127.0.0.2 with SMTP id TSZRYY7687511xMSedvkZlsw; Mon, 17 Jul 2023 19:45:24 -0700 X-Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by mx.groups.io with SMTP id smtpd.web11.3316.1689648323611778946 for ; Mon, 17 Jul 2023 19:45:23 -0700 X-Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-666e6541c98so5262301b3a.2 for ; Mon, 17 Jul 2023 19:45:23 -0700 (PDT) X-Gm-Message-State: h7tMY4fOyX1ZhCvH8NJoYyC5x7686176AA= X-Google-Smtp-Source: APBJJlFodI3QZ3rXPCAqJeOGrX7yAISSHoeXcDVhJUr/FxXaVs3QJLgDBOHGE9XJlUeTY8f0/10TIg== X-Received: by 2002:a05:6a20:8e0a:b0:12f:bc36:4c67 with SMTP id y10-20020a056a208e0a00b0012fbc364c67mr17744182pzj.61.1689648322957; Mon, 17 Jul 2023 19:45:22 -0700 (PDT) X-Received: from [192.168.50.35] ([50.46.230.135]) by smtp.gmail.com with ESMTPSA id x17-20020aa784d1000000b006829b28b393sm428963pfn.199.2023.07.17.19.45.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 17 Jul 2023 19:45:22 -0700 (PDT) Message-ID: <82fd0dfe-e746-bc37-1070-f248cef4c760@taylorbeebe.com> Date: Mon, 17 Jul 2023 19:45:21 -0700 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [edk2-devel] [PATCH 00/14] Implement Dynamic Memory Protections To: Pedro Falcato , Ard Biesheuvel Cc: devel@edk2.groups.io, Jian J Wang , Liming Gao , Dandan Bi , Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann , Leif Lindholm , Sami Mujawar , Andrew Fish , Ray Ni , Eric Dong , Rahul Kumar , Guo Dong , Sean Rhodes , James Lu , Gua Guo References: From: "Taylor Beebe" In-Reply-To: Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,t@taylorbeebe.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=jNG7iuFn; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=none On 7/17/23 9:49 AM, Pedro Falcato wrote: > On Mon, Jul 17, 2023 at 5:26 PM Ard Biesheuvel wrote: >> >> On Mon, 17 Jul 2023 at 18:15, Pedro Falcato wrote: >>> >>> On Wed, Jul 12, 2023 at 12:53 AM Taylor Beebe wrote: >>>> >>>> In the past, memory protection settings were configured via FixedAtBuild PCDs, >>>> which resulted in a build-time configuration of memory mitigations. This >>>> approach limited the flexibility of applying mitigations to the >>>> system and made it difficult to update or adjust the settings post-build. >>> >>> How do you mitigate the possibility of an attack overwriting the >>> dynamic configuration data (the HOBs)? >>> It seems most dangerous to me to publish this sort of >>> security-sensitive configuration knobs dynamically such that an >>> attacker can change them. >>> >> >> That is a very good point. One of the things I have on my TODO list >> for the memory attributes PEI work is to remap HOB memory read-only >> before entering DXE. They are conceptually read-only anyway when PEI >> completes, so they should never be modified afterwards. > > I agree, but it also seems that this patch set needs some sort of > __ro_after_init capabilities. For example, in > https://github.com/tianocore/edk2/pull/4566/commits/e485459b6efb1e49591c6f3011d9da14746c52bc#diff-02c0ef19d024b43162043efdd9ed95e0eef1653bcb5bef1e2f2b77587aee2622R101 > (DxeMemoryProtectionHobLibConstructor), a copy of this same HOB is > made onto .data, while it should be RO-protected as well. > With both the HOB list and this sort of __ro_after_init protected, the > only remaining exploits would be to DMA over those pages (addressed by > IOMMU, not in this scope), to remap those pages (requires ring 0 > access, therefore irrelevant) or to toggle some sort of WP-like bit > (CR0.WP, other archs may have equivalents), which already bypasses > most of the memory protections and therefore isn't all that concerning > to me. > Thank you both for you time and feedback. Ard, do you think it's sufficient to use the Memory Attribute PPI to mark HOB list memory as RO before handoff, or should the HOB list memory be marked RO upon memory discovery and the PEI core HOB logic be updated to manipulate protection attributes with the PPI as it manipulates the HOB list? -Taylor -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#106976): https://edk2.groups.io/g/devel/message/106976 Mute This Topic: https://groups.io/mt/100090629/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-