From 19d8a42303588d69e58b3400e2e6f9b32351a7ce Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Tue, 15 Sep 2026 15:35:10 +0200 Subject: [PATCH] F-6765: scrub previous value before overwriting PSA storage ARM_TEE_PS_SET on an existing object XMEMCPY'd the new value over the old one without clearing the buffer first, so a SET that stores less data (or zero data) left the tail of the previous object readable through ARM_TEE_PS_GET. Zero the full data area with wc_ForceZero after every validation check passes and before the copy, matching the DELETE path. Reported by Fenrir. --- src/arm_tee_psa_ipc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/arm_tee_psa_ipc.c b/src/arm_tee_psa_ipc.c index f6244585..63223279 100644 --- a/src/arm_tee_psa_ipc.c +++ b/src/arm_tee_psa_ipc.c @@ -925,6 +925,10 @@ static int32_t arm_tee_psa_ps_dispatch(int32_t type, const psa_invec *in_vec, if (data_len > 0 && data == NULL) { return PSA_ERROR_INVALID_ARGUMENT; } + /* Scrub the previous value before overwriting: a SET that stores + * less data (or zero) must not leave the tail of the old object + * readable via GET. Runs only after every validation check. */ + wc_ForceZero(entry->data, sizeof(entry->data)); if (data_len > 0) { XMEMCPY(entry->data, data, data_len); }