From 86cbb86e86ee9f2c926624b671ac2516494bfe47 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Wed, 8 Nov 2023 17:04:12 +0200 Subject: [PATCH 01/10] uintptr_t does not maintain provenance information --- pointerProvenanceIssue.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 pointerProvenanceIssue.c diff --git a/pointerProvenanceIssue.c b/pointerProvenanceIssue.c new file mode 100644 index 0000000..94d9761 --- /dev/null +++ b/pointerProvenanceIssue.c @@ -0,0 +1,27 @@ + +#include +#include + +int main () { + +int myArray[10]; + +uintptr_t ptr = (uintptr_t)&myArray[0]; //storing the address as uintptr_t + +//performing an invalid operation - accessing a non existent element + +uintptr_r myPtr = ptr + sizeof(int)* 20; + +//trying to accessing the memory using an invalid pointer + +int myValue = *(int*)myPtr // no memory safety checks + +printf("invalid value : %d\n ",myValue); + + +return 0; + +} + + + From 24ca03a4e5c56ad455183978966b84de4af2c05d Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Wed, 8 Nov 2023 17:28:28 +0200 Subject: [PATCH 02/10] Provenance of the pointer tracks --- CHERIProvenanceOfPointer.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 CHERIProvenanceOfPointer.c diff --git a/CHERIProvenanceOfPointer.c b/CHERIProvenanceOfPointer.c new file mode 100644 index 0000000..ee30f60 --- /dev/null +++ b/CHERIProvenanceOfPointer.c @@ -0,0 +1,22 @@ +#include +#include + +int main(){ + +int myArray[10]; + +int *ptr = &myArray[0]; // storing the pointer as a capability + +//perform a capability safe operation - accessing a valid element + +int myValue = *ptr; + +// access within bounds + +int *new_ptr = ptr + 5; + +printf("valid value : %d\n", myValue); + +return 0; + +} From 589bfa36da9b6e849031147251f5a100cfa75da8 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Wed, 8 Nov 2023 18:53:13 +0200 Subject: [PATCH 03/10] CHERI facilitates sweeping revocation technique --- CHERIcapabilitySweepingRevocation.c | 47 +++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 CHERIcapabilitySweepingRevocation.c diff --git a/CHERIcapabilitySweepingRevocation.c b/CHERIcapabilitySweepingRevocation.c new file mode 100644 index 0000000..8592e96 --- /dev/null +++ b/CHERIcapabilitySweepingRevocation.c @@ -0,0 +1,47 @@ +#include +#include +int main() { + +//create a capability to a memory region + +int data[10] = {0}; + +cheri_object data_cap; + +data_cap = cheri_build_data_cap(data, sizeof(data), CHERI_PERM_LOAD|CHERI_PERM_STORE); + +//read and write access capability + +int* cap_ptr = cheri_cast(int*, data_cap); + +//read and write data + +cap_ptr[0] = 42; + +int value = cap_ptr[0]; + +printf("initial value: %d\n", value); + +//let's simulate a security breach or a vulnerability detection + +//decide to revoke or write access to the memory region + +cheri_set_perms(&data_cap,CHERI_PERM_LOAD);//revoke write permissions + +//attempting to write after revoking triggers an exception + +//uncommenting this line would trigger a capability violation exception + +//cap_ptr[1]=99; + +//however,read access remains allowed + +int read_value = cap_ptr[1]; + +printf("read only value: %d\n", read_value); + +return 0; + + +} + From c8a0b5335779d61d711039bf111e6d2aa10de4f3 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Thu, 9 Nov 2023 12:25:37 +0200 Subject: [PATCH 04/10] Insecure encapsulation access --- LackofSecureEncapsulationIssue.c | 51 ++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 LackofSecureEncapsulationIssue.c diff --git a/LackofSecureEncapsulationIssue.c b/LackofSecureEncapsulationIssue.c new file mode 100644 index 0000000..97ab6f5 --- /dev/null +++ b/LackofSecureEncapsulationIssue.c @@ -0,0 +1,51 @@ +#include +#include + +struct Student { + +char name[100]; + +int age; + +}; + +struct Student* create_student(char name*, int age); + +struct Student* student = (struct Student*)malloc(sizeof(struct Student)); + +if(student){ + +strcpy(student->name, name); + +student->age = age; + +} + +return student; + +} + +int main() { + +struct Student* student1 = create_student("Alice", 20); + +struct Student* student2 = create_student("Bob", 22); + +//unintentional access to students data (no encapsulation) + +printf("student1: %s,%d\n", student2->name, student2->age); + +free(student1); +free(student2); + +return 0; + +} + + + + + + + + From bba7a98fd43067c0e3014500f92d3a594ca29557 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Thu, 9 Nov 2023 12:42:14 +0200 Subject: [PATCH 05/10] Secure encapsulation --- CHERISecureEncapsulation.c | 52 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 CHERISecureEncapsulation.c diff --git a/CHERISecureEncapsulation.c b/CHERISecureEncapsulation.c new file mode 100644 index 0000000..c5fc6cf --- /dev/null +++ b/CHERISecureEncapsulation.c @@ -0,0 +1,52 @@ +#include +#include +#include + +struct Student{ + +char name[100]; + +int age; + +}; + +//component1 + +void component1(void* studentCapability){ + +struct Student* student = cheri_setbounds(studentCapability,sizeof(struct Student)); + +strcpy(student->name,"Alice"); + +student->age=20; + +} + +//component2 + +void component2(void* studentCapability){ + +struct Student* student = cheri_setbounds(studentCapability,sizeof(struct Student)); + +printf("componet2 reads: Name: %s, Age: %d\n", student->name, student->age); + +} + +int main (){ + +//memory allocation for the student data + +struct Student sharedStudent; + +void* studentCapability = cheri_setbounds(&sharedStudent,sizeof(struct Student)); + +//components use capability to access the shared student data + +component1(studentCapability); +component2(studentCapability); + +return 0; + +} + + From 4e54d5550724c094375766986b3cbb80907a2021 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Thu, 9 Nov 2023 12:52:13 +0200 Subject: [PATCH 06/10] In address space protection issue --- LacksSingleInAddressSpaceProtection.c | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 LacksSingleInAddressSpaceProtection.c diff --git a/LacksSingleInAddressSpaceProtection.c b/LacksSingleInAddressSpaceProtection.c new file mode 100644 index 0000000..20a97aa --- /dev/null +++ b/LacksSingleInAddressSpaceProtection.c @@ -0,0 +1,30 @@ +#include +#include + +char sharedData[100]; + +//component1 +void component1(){ + +strcpy(sharedData, "Data from component1"); + +} + +//component2 +void component2(){ + +printf("component2 reads: %s\n", sharedData); + +} + +int main(){ + +component1(); + +component2(); + +return 0; + +} + + From 2ef4cc8dc1e8d6a84ff6ab993d8160d0aa0d41bd Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Thu, 9 Nov 2023 13:01:53 +0200 Subject: [PATCH 07/10] Single in address space protection --- CHERIIn-Address-Space-Protection.c | 41 ++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 CHERIIn-Address-Space-Protection.c diff --git a/CHERIIn-Address-Space-Protection.c b/CHERIIn-Address-Space-Protection.c new file mode 100644 index 0000000..b4e6bd7 --- /dev/null +++ b/CHERIIn-Address-Space-Protection.c @@ -0,0 +1,41 @@ +#include + +struct capData { + +char data[100]; + +}; + +void component1(){ + +struct capData* sharedData =(struct capData*)cheri_malloc(sizeof(struct capData)); + +strcpy(sharedData->data, "Data from component1"); + +//.. some code to pass sharedData to component2 + +} + +//component2 + +void component2(struct capData* sharedData) { + +printf("component2 read: %s\n",sharedData ->data); + +} + +int main() { + + +struct capData* sharedData = NULL; + +component1(&sharedData); +component2(sharedData);//ensures that capability restricts access + +cheri_free(sharedData); + +return 0; + +} + + From ed9b42d332b333f1a200dff4134fb99f4c993a40 Mon Sep 17 00:00:00 2001 From: =josephproject1 <=joseph.kaberuka@glasgow.ac.uk> Date: Thu, 9 Nov 2023 13:21:31 +0200 Subject: [PATCH 08/10] Application compartmentalization --- ApplicationCompartmentalization.c | 45 +++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 ApplicationCompartmentalization.c diff --git a/ApplicationCompartmentalization.c b/ApplicationCompartmentalization.c new file mode 100644 index 0000000..857134c --- /dev/null +++ b/ApplicationCompartmentalization.c @@ -0,0 +1,45 @@ +#include +#include + +void componentA(){ + +char buffer[128]; + +//Assume cap_A is a capability for component A's memory + +_capability char* buffer_cap = cheri_setbounds(buffer, sizeof(buffer)); + +gets(buffer_cap); //protected by componentA's capability + +printf("componentA : You entered : %s\n", buffer); + +} + +void componentB (){ + +int secret_data =42; + +//Assume cap_B is a capability for component B's memory + +// componentB has no access to componentA's memory + + + +_capability int* secret_data_cap = cheri_setbounds(&secret_data, sizeof(secret_data)); + +printf("componentB secret data is %d\n", *secret_data_cap); + +} + +int main() { + +// component A and component B are isolated with separate capabilities + +componentA(); +componentB(); + +return 0; + +} + + From 5824d98874869dad6553e8cc72ae9725e3dcaa52 Mon Sep 17 00:00:00 2001 From: = <=> Date: Mon, 20 Nov 2023 13:24:34 +0200 Subject: [PATCH 09/10] Morello stack buffer over flow protection --- bufferOverflow.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 bufferOverflow.c diff --git a/bufferOverflow.c b/bufferOverflow.c new file mode 100644 index 0000000..88b81ae --- /dev/null +++ b/bufferOverflow.c @@ -0,0 +1,27 @@ +#include + +void foo(char *str) + +{ + +char buffer[12]; + +/* The following statement will result in a buffer overflow */ + +strcpy(buffer, str); + +} + +int main() + +{ + +char *str = "This is definitely longer than 12"; + + +foo(str); + + +return 1; + +} From cddf02a0f704a0c6f258677d37de5296536b5752 Mon Sep 17 00:00:00 2001 From: Jeremy Singer Date: Fri, 24 Nov 2023 11:01:56 +0000 Subject: [PATCH 10/10] Update LackofSecureEncapsulationIssue.c fix up some syntax errors --- LackofSecureEncapsulationIssue.c | 46 +++++++++++--------------------- 1 file changed, 16 insertions(+), 30 deletions(-) diff --git a/LackofSecureEncapsulationIssue.c b/LackofSecureEncapsulationIssue.c index 97ab6f5..ce2d96f 100644 --- a/LackofSecureEncapsulationIssue.c +++ b/LackofSecureEncapsulationIssue.c @@ -2,44 +2,30 @@ #include struct Student { - -char name[100]; - -int age; - + char name[100]; + int age; }; -struct Student* create_student(char name*, int age); - -struct Student* student = (struct Student*)malloc(sizeof(struct Student)); - -if(student){ - -strcpy(student->name, name); - -student->age = age; - -} - -return student; - +struct Student* create_student(char name*, int age) { + struct Student* student = (struct Student*)malloc(sizeof(struct Student)); + if(student){ + strcpy(student->name, name); + student->age = age; + } + return student; } int main() { + struct Student* student1 = create_student("Alice", 20); + struct Student* student2 = create_student("Bob", 22); -struct Student* student1 = create_student("Alice", 20); - -struct Student* student2 = create_student("Bob", 22); - -//unintentional access to students data (no encapsulation) - -printf("student1: %s,%d\n", student2->name, student2->age); - -free(student1); -free(student2); + // unintentional access to students data (no encapsulation) + printf("student1: %s,%d\n", student2->name, student2->age); -return 0; + free(student1); + free(student2); + return 0; }