Skip to content

Fix HKDF implementation to prevent buffer overrun when compiled with NX_SECURE_KEY_CLEAR #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

sjscymru
Copy link

The _nx_crypto_method_hkdf_cleanup method is passing the incorrect pointer to the HMAC method cleanup when NetX is compiled with NX_SECURE_KEY_CLEAR.

When NX_SECURE_KEY_CLEAR defined, calling _nx_crypto_method_hkdf_cleanup will result in a subsequent call to the HMAC method (if one is set) cleanup function. However the incorrect parameter is being passed, currently HKDF passes in the a pointer to the NX_CRYPTO_METHOD structure of the HMAC method, which is 32 bytes in size.

status = hmac_method -> nx_crypto_cleanup(hmac_method);

But the HMAC cleanup method is calling NX_CRYPTO_MEMSET() on the provided pointer using sizeof(NX_CRYPTO_HMAC) which is 292 bytes is size:

/* Clean up the crypto metadata.  */
NX_CRYPTO_MEMSET(crypto_metadata, 0, sizeof(NX_CRYPTO_HMAC));

This leads to a buffer overflow of 260 bytes. The actual amount can vary depending of the exact HMAC method being used.

…potential buffer overflow due to incorrect pointer being passed to HMAC cleanup if NetX is build with NX_SECURE_KEY_CLEAR defined.
@fdesbiens fdesbiens requested a review from a team May 27, 2025 13:10
@fdesbiens
Copy link
Contributor

Thank you for this contribution, @sjscymru.

@eclipse-threadx/iot-threadx-committers: Please review.

@fdesbiens fdesbiens added the discussion Flagged for discussion during the weekly team meeting label May 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discussion Flagged for discussion during the weekly team meeting
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants