WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-6130: clear disk_encrypt_key/nonce before panic paths that skip the final cleanup 

update_disk.c wolfBoot_start() already zeroizes disk_encrypt_key/nonce and
the decrypted header before most wolfBoot_panic() halts, but four paths
were missed: anti-rollback rejection, FIT FPGA load failure, FIT kernel
load failure, and flash-protect failure. Since wolfBoot_panic() halts
forever on real targets, these paths left the key live in BSS on a halted
device. Add the same disk_decrypted_header_clear()/disk_crypto_clear()
pair used on the other panic paths immediately before each.
pull/814/head
Daniele Lacamera 2026-07-02 15:23:43 +02:00
parent e38296c984
commit dd0712ec52
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/update_disk.c
View File

@ -397,6 +397,10 @@ void RAMFUNCTION wolfBoot_start(void)
uint32_t cur_ver = selected ? pB_ver_u : pA_ver_u;
if ((max_ver > 0U) && (cur_ver < max_ver)) {
wolfBoot_printf("Rollback to lower version not allowed\r\n");
#ifdef DISK_ENCRYPT
disk_decrypted_header_clear(dec_hdr);
disk_crypto_clear();
#endif
wolfBoot_panic();
return;
}
@ -573,6 +577,10 @@ void RAMFUNCTION wolfBoot_start(void)
if (fpga != NULL) {
if (fit_load_fpga(fit, fpga) != 0) {
wolfBoot_printf("FIT: FPGA load failed\r\n");
#ifdef DISK_ENCRYPT
disk_decrypted_header_clear(dec_hdr);
disk_crypto_clear();
#endif
wolfBoot_panic();
}
}
@ -584,6 +592,10 @@ void RAMFUNCTION wolfBoot_start(void)
if (new_load == NULL) {
wolfBoot_printf("FIT: failed to load kernel '%s'\r\n",
kernel);
#ifdef DISK_ENCRYPT
disk_decrypted_header_clear(dec_hdr);
disk_crypto_clear();
#endif
wolfBoot_panic();
}
load_address = new_load;
@ -627,6 +639,10 @@ void RAMFUNCTION wolfBoot_start(void)
#ifndef TZEN
if (hal_flash_protect(WOLFBOOT_ORIGIN, BOOTLOADER_PARTITION_SIZE) < 0) {
wolfBoot_printf("Error protecting bootloader flash region\r\n");
#ifdef DISK_ENCRYPT
disk_decrypted_header_clear(dec_hdr);
disk_crypto_clear();
#endif
wolfBoot_panic();
}
#endif

8
tools/unit-tests/unit-update-disk.c
View File

@ -361,6 +361,8 @@ END_TEST
START_TEST(test_update_disk_rejects_rollback_after_higher_image_failure)
{
size_t i;
reset_mocks();
build_image(part_a_image, 7, 0xA1);
build_image(part_b_image, 5, 0xB2);
@ -370,6 +372,12 @@ START_TEST(test_update_disk_rejects_rollback_after_higher_image_failure)
ck_assert_int_gt(wolfBoot_panicked, 0);
ck_assert_int_eq(mock_do_boot_called, 0);
for (i = 0; i < ENCRYPT_KEY_SIZE; i++) {
ck_assert_uint_eq(disk_encrypt_key[i], 0);
}
for (i = 0; i < ENCRYPT_NONCE_SIZE; i++) {
ck_assert_uint_eq(disk_encrypt_nonce[i], 0);
}
}
END_TEST