espressif: Clear sensitive buffers from stack after use - #2800
Open
d3zd3z wants to merge 1 commit into
Open
Conversation
The flash-encryption HAL left two stack buffers holding secret material live after use. check_and_generate_encryption_keys() populated a local keys array with the raw XTS-AES flash-encryption key and passed it to esp_efuse_write_keys() without clearing it before returning, on either the success or the error path. esp_flash_encrypt_region() read each plaintext flash sector into a local buffer to re-encrypt it in place and returned with the last sector's plaintext still resident, on both the success and failure returns. Clear both buffers before they go out of scope with bootutil_wipe_memory(), which writes through a volatile pointer so the stores are not elided as a dead store the way a plain memset() or bzero() on a soon-discarded buffer can be. Assisted-by: Claude:opus-4.8 Signed-off-by: David Brown <david.brown@linaro.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Espressif flash-encryption HAL keeps two stack buffers holding key/plaintext
material live after use:
check_and_generate_encryption_keys()populates a localkeysarray with theraw XTS-AES flash-encryption key, writes it to eFuse via
esp_efuse_write_keys(),and returns with
keysstill resident on the stack — on both the success and theerror paths.
esp_flash_encrypt_region()reads each plaintext flash sector into a localbufto re-encrypt it in place, and returns (both the success
returnand theflash_failedpath) with the last plaintext sector still resident inbuf.This clears both buffers before they go out of scope.
The wipe uses
bootutil_wipe_memory()rather thanmemset()/bzero(): a plainmemset/bzeroon a buffer that is not read again before it leaves scope is adead store the compiler may legally eliminate, so it is not a reliable way to
clear a buffer.
bootutil_wipe_memory()writes through avolatilepointer andis not elided. Its translation unit (
boot/bootutil/src/bootutil_misc.c) isalready linked into the Espressif target, so it is forward-declared locally to
avoid pulling the full
bootutil/bootutil.hinclude chain into the HALsub-library.
This is Espressif-port code, so it is not built by the Rust simulator; verified by
inspection and covered by the
espressifCI build.