WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-3741: zeroize digest and hash in uds_from_uid for stm32l5/stm32h5 

Add hal_secret_zeroize calls for the digest buffer and SHA context
after memcpy in uds_from_uid, matching the existing pattern applied
to the OTP path in hal_uds_derive_key. Also moves/adds hal_secret_zeroize
definition before uds_from_uid so it is available at the call site.
pull/795/head
Daniele Lacamera 2026-06-11 18:26:20 +02:00
parent ef85a1ec3f
commit a10a993cd2
2 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
hal/stm32h5.c
View File

@ -182,6 +182,14 @@ __attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
#endif
#if defined(WOLFCRYPT_TZ_PSA)
static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
{
volatile uint8_t *p = (volatile uint8_t *)ptr;
while (len-- > 0U) {
*p++ = 0U;
}
}
static int uds_from_uid(uint8_t *out, size_t out_len)
{
uint8_t uid[12];
@ -231,6 +239,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
copy_len = out_len;
}
memcpy(out, digest, copy_len);
hal_secret_zeroize(digest, sizeof(digest));
hal_secret_zeroize(&hash, sizeof(hash));
return 0;
}
@ -246,14 +256,6 @@ static int buffer_is_all_value(const uint8_t *buf, size_t len, uint8_t value)
return 1;
}
static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
{
volatile uint8_t *p = (volatile uint8_t *)ptr;
while (len-- > 0U) {
*p++ = 0U;
}
}
int hal_uds_derive_key(uint8_t *out, size_t out_len)
{
#if defined(FLASH_OTP_KEYSTORE)

10
hal/stm32l5.c
View File

@ -120,6 +120,14 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
#define STM32L5_UID2 (*(volatile uint32_t *)(STM32L5_UID_BASE + 0x8))
#if defined(WOLFCRYPT_TZ_PSA)
static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
{
volatile uint8_t *p = (volatile uint8_t *)ptr;
while (len-- > 0U) {
*p++ = 0U;
}
}
static int uds_from_uid(uint8_t *out, size_t out_len)
{
uint8_t uid[12];
@ -173,6 +181,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
copy_len = out_len;
}
memcpy(out, digest, copy_len);
hal_secret_zeroize(digest, sizeof(digest));
hal_secret_zeroize(&hash, sizeof(hash));
return 0;
}