Uploaded image for project: 'MCUboot'
  1. MCUB-56

Split booting may use uninitialized memory in crypto checks

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: High
    • Resolution: Done
    • Affects versions: None
    • Fix versions: 1.1.0
    • Components: Image Management
    • Labels:
      None

      Description

      The split_go() routine in mcuboot/boot/bootutil/src/loader.c makes use of the boot_read_image_headers() helper provided for "dual image area with swap" style boots:

      {code:c}
      int
      split_go(int loader_slot, int split_slot, void **entry)
      {
      const struct flash_area *loader_fap;
      const struct flash_area *app_fap;
      struct flash_area *sectors;
      uintptr_t entry_val;
      int loader_flash_id;
      int app_flash_id;
      int rc;
      // [...]
      rc = boot_read_image_headers();
      // [...]
      rc = split_image_check(&boot_data.imgs[split_slot].hdr,
      app_fap,
      &boot_data.imgs[loader_slot].hdr,
      loader_fap);
      // [...]
              }
      {code}

      boot_read_image_headers() should not be used in this context: it can return success if *some* of the headers were read correctly, which may be enough if image slots contain complete images for swapping. However, split_go() treats success as if *both* image area headers were read correctly.

      The problem is that a success return from boot_read_image_headers() if slot 0's header was read correctly and slot 1's wasn't results in garbage data being passed to split_image_check(). This could potentially be combined with another bug to feed attacker-controlled data to split_image_check().

      This ticket tracks fixing split_go() to validate that all of its inputs are read correctly before passing them off for validation.

        Attachments

          Activity

            People

            • Assignee:
              utzig Fabio Utzig
              Reporter:
              marti.bolivar Marti Bolivar (Inactive)
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Backbone Issue Sync