MdeModulePkg: introduce UEFI freed-memory guard bit in HeapGuard PCD
UAF (Use-After-Free) memory issue is kind of illegal access to memory which has been freed. It can be detected by a new freed-memory guard enforced onto freed memory. BIT4 of following PCD is used to enable the freed-memory guard feature. gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask Please note this feature is for debug purpose and should not be enabled in product BIOS, and cannot be enabled with pool/page heap guard at the same time. It's disabled by default. Cc: Star Zeng <star.zeng@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Ruiyu Ni <ruiyu.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
@@ -1011,14 +1011,22 @@
|
||||
gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType|0x0|UINT64|0x30001053
|
||||
|
||||
## This mask is to control Heap Guard behavior.
|
||||
# Note that due to the limit of pool memory implementation and the alignment
|
||||
# requirement of UEFI spec, BIT7 is a try-best setting which cannot guarantee
|
||||
# that the returned pool is exactly adjacent to head guard page or tail guard
|
||||
# page.
|
||||
#
|
||||
# Note:
|
||||
# a) Heap Guard is for debug purpose and should not be enabled in product
|
||||
# BIOS.
|
||||
# b) Due to the limit of pool memory implementation and the alignment
|
||||
# requirement of UEFI spec, BIT7 is a try-best setting which cannot
|
||||
# guarantee that the returned pool is exactly adjacent to head guard
|
||||
# page or tail guard page.
|
||||
# c) UEFI freed-memory guard and UEFI pool/page guard cannot be enabled
|
||||
# at the same time.
|
||||
#
|
||||
# BIT0 - Enable UEFI page guard.<BR>
|
||||
# BIT1 - Enable UEFI pool guard.<BR>
|
||||
# BIT2 - Enable SMM page guard.<BR>
|
||||
# BIT3 - Enable SMM pool guard.<BR>
|
||||
# BIT4 - Enable UEFI freed-memory guard (Use-After-Free memory detection).<BR>
|
||||
# BIT6 - Enable non-stop mode.<BR>
|
||||
# BIT7 - The direction of Guard Page for Pool Guard.
|
||||
# 0 - The returned pool is near the tail guard page.<BR>
|
||||
|
Reference in New Issue
Block a user