A Tour Beyond BIOS - Security Enhancement to Mitigate Buffer Overflow in UEFI
Executive Summary
Stack Canaries
Stack Check Support in Microsoft Visual Studio
Stack Check Support in GCC
Enable Stack Check in EDK II
Future work
Data Execution Protection
DEP in X86 Processor
DEP in UEFI specification
Enable DEP in EDK II
Future work
Address Space Layout Randomization
ASLR in Windows
ASLR in *nix
ASLR requirement in UEFI firmware
Enable ASLR for UEFI in EDK II
Enable ASLR for SMM in EDK II
Future work
Additional Overflow Detection
Stack Overflow Detection
Heap Management in EDKII
Heap Overflow Detection (for Page)
Heap Overflow Detection (for Pool)
NULL Pointer Protection in EDK II
Read-only page table
Limitation
Compatibility Consideration
Call for action
Future work
Summary
Policy Control
References
Published with GitBook
Additional Overflow Detection
Security Enhancement to Mitigate Buffer Overflow in UEFI
DRAFT
Revision 02.0
Additional Overflow Detection
Besides the mechanism discussed above, we may use other mechanisms to detect buffer overflow.
Security Enhancement to Mitigate Buffer Overflow in UEFI
DRAFT
Revision 02.0