Skip to content

Potential PLDM Instance ID Leak #141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
santoshpuranik opened this issue May 25, 2022 · 0 comments
Open

Potential PLDM Instance ID Leak #141

santoshpuranik opened this issue May 25, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@santoshpuranik
Copy link
Contributor

We call PldmFramework::getInstanceID() to get a new PLDM instance ID each time someone executes a function that requires us to initiate a PLDM transfer to PHYP.

The panel code then calls pldm_send() to send the PLDM packet it creates. pldm_send() does not tell us if the remote end responded to the call. In case we do not receive a response, the expectation is that the previously generated instance ID be reused and the app not create a new one (the previous ID gets leaked in this case)

This issue is to figure out a solution to this potential issue. Idea include:

  • Track each instance ID with a timeout (worse case of 5.4s).
  • Move to pldm_send_recv() with an asio wrapper around it, this will ensure we get a response for every send.
@santoshpuranik santoshpuranik added the enhancement New feature or request label May 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant