Closed
Description
Problem
- Dynamic runtime analysis at Google found that random data from memory was stored in persistent storage in unused key slots, possibly revealing memory at the time of storage, and also storing garbage data.
Stack frame
#0 0x7f47f5827cd4 in chip::Credentials::KeySetData::Serialize(chip::TLV::TLVWriter&) const [src/credentials/GroupDataProviderImpl.cpp:785]
#1 0x7f47f581ea0b in Save [src/credentials/GroupDataProviderImpl.cpp:60]
#2 0x7f47f581ea0b in chip::Credentials::GroupDataProviderImpl::SetKeySet(unsigned char, chip::Span<unsigned char const> const&, chip::Credentials::GroupDataProvider::KeySet const&) [src/credentials/GroupDataProviderImpl.cpp:1615]
#3 0x7f47fd9d8301 in chip::Credentials::SetSingleIpkEpochKey(chip::Credentials::GroupDataProvider*, unsigned char, chip::Span<unsigned char const> const&, chip::Span<unsigned char const> const&) [src/credentials/GroupDataProvider.h:395].....
Proposed Solution
- Use default values in the slots beyond the last one used by a real key
- Cannot avoid writing entries without breaking already commissioned devices storage format. Therefore blank entries must be written to remain compatible.
Activity