WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-7048: make UDS all-value scan constant-time 

buffer_is_all_value() early-exited on the first byte differing from
the target, so the loop trip count leaked the length of the leading
0xFF/0x00 run of the UDS, the DICE root secret read in
hal_uds_derive_key().

Replace the early exit with a volatile |= accumulator over the full
buffer, matching the constant-time compare pattern already used by
image_CT_compare() and the other secret comparisons in the tree.

Verified: gcc -S -O2 shows a straight-line loop body with only the
data-independent i < len branch; arm-none-eabi-gcc (stm32h5 preset)
compiles the file clean.

Reported by Fenrir.
pull/892/head
Daniele Lacamera 2026-09-15 15:48:15 +02:00
parent 5f6eb05552
commit 908d4ec1e3
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hal/stm32h5.c
View File

@ -247,14 +247,15 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
static int buffer_is_all_value(const uint8_t *buf, size_t len, uint8_t value)
{
volatile uint8_t diff = 0U;
size_t i;
/* Constant-time scan: the buffer holds the UDS, the DICE root
* secret, so the loop must not early-exit on a data-dependent byte. */
for (i = 0; i < len; i++) {
if (buf[i] != value) {
return 0;
}
diff |= (uint8_t)(buf[i] ^ value);
}
return 1;
return diff == 0;
}
int hal_uds_derive_key(uint8_t *out, size_t out_len)