mirror of https://github.com/wolfSSL/wolfBoot.git
0412238414
wcs_fwtpm_transmit() verified that cmd identifies non-secure memory and then passed that mutable buffer directly to FWTPM_ProcessCommand. The processor parses the packet more than once (authentication, then handler execution), so a DMA-capable non-secure attacker who rewrites the command buffer in the window between the two parses can make the authenticated command differ from the executed command. Copy exactly cmdSz bytes into a secure staging buffer after the range validation and invoke the processor only on that copy: an NS DMA master cannot rewrite secure memory, so both parses see the same bytes. The command and response staging are zeroed before returning (the response may carry auth tags or unsealed data). unit-fwtpm-cmd-toctou includes the real fwtpm_callable.c and mocks FWTPM_ProcessCommand with two parse points (authentication, execution). The test plays the attacker, rewriting the NS command buffer at the window between the parses - the mock may only touch the caller's buffer, never secure staging, mirroring the hardware boundary. Pre-fix the processor authenticated the original bytes and executed the rewritten ones (test fails); post-fix both parses see the original command. Verification: - Built: unit tests compile the real veneer (host, poisoned fwtpm headers, same pattern as unit-fwtpm-nv-oob). - Tested: unit-fwtpm-cmd-toctou 2/2 (red demonstrated against the pre-fix veneer via git stash of the fix); sibling unit-fwtpm-rsp-overrun 3/3 and unit-fwtpm-nv-oob 4/4 after the change. - Pitfalls: the staging copy happens after all NS range checks and before any processor access; zeroing covers the full staging buffers regardless of the produced length. - Style: cstyle-check.sh flag count on src/fwtpm_callable.c unchanged (1 pre-existing); the new test trips only the uncrustify pointer-alignment class the sibling unit tests trip. - Message: F-11044: prefix, no co-author trailers. - Unverified: no CMSE/armclang build and no m33mu emulator run here (lib/wolftpm is not checked out in this tree); the trustzone-emulator workflow covers the full build on push. |
||
|---|---|---|
| .. | ||
| armclang | ||
| bin-assemble | ||
| check_config | ||
| ci | ||
| delta | ||
| efi | ||
| elf-parser | ||
| fdt-parser | ||
| keytools | ||
| lms | ||
| openocd | ||
| renode | ||
| sbom | ||
| scripts | ||
| squashelf | ||
| test-expect-version | ||
| test-update-server | ||
| tpm | ||
| uart-flash-server | ||
| unit-tests | ||
| xmss | ||
| config.mk | ||
| test-delta.mk | ||
| test-enc.mk | ||
| test-renode.mk | ||
| test.mk | ||
| wolfboot-rpi-devicetree.diff | ||