Skip to content

Commit 053d169

Browse files
authored
Merge pull request #751 from danielinux/fixes-20260415
Fixes 20260415 - fix finding from static analysis
2 parents 877ffea + 73c2962 commit 053d169

File tree

13 files changed

+219
-18
lines changed

13 files changed

+219
-18
lines changed

.github/workflows/test-hooks-simulator.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,11 @@ jobs:
8888
WOLFBOOT_HOOK_BOOT=1 \
8989
WOLFBOOT_HOOK_PANIC=1
9090
91+
- name: Run dualbank rollback denial simulation
92+
if: matrix.mechanism == 'dualbank'
93+
run: |
94+
tools/scripts/sim-dualbank-rollback-denied.sh
95+
9196
- name: Clear hook log
9297
run: |
9398
rm -f /tmp/wolfboot_hooks.log

.github/workflows/test-sunnyday-simulator.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ jobs:
5454
cp config/examples/sim-dualbank.config .config
5555
make test-sim-internal-flash-with-update
5656
57+
- name: Run dualbank rollback denial simulation
58+
run: |
59+
tools/scripts/sim-dualbank-rollback-denied.sh
60+
5761
- name: Run dualbank swap simulation
5862
run: |
5963
tools/scripts/sim-dualbank-swap-update.sh

src/libwolfboot.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1395,6 +1395,15 @@ int wolfBoot_dualboot_candidate(void)
13951395
(wolfBoot_get_partition_state(candidate, &p_state) == 0) &&
13961396
(p_state == IMG_STATE_TESTING))
13971397
{
1398+
#ifndef ALLOW_DOWNGRADE
1399+
uint32_t candidate_v = (candidate == PART_BOOT) ? boot_v : update_v;
1400+
uint32_t fallback_v = (candidate == PART_BOOT) ? update_v : boot_v;
1401+
1402+
if (fallback_v < candidate_v) {
1403+
wolfBoot_printf("Rollback to lower version not allowed\n");
1404+
return candidate;
1405+
}
1406+
#endif
13981407
wolfBoot_erase_partition(candidate);
13991408
candidate ^= 1; /* switch to other partition if available */
14001409
}

src/update_disk.c

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -253,12 +253,14 @@ void RAMFUNCTION wolfBoot_start(void)
253253
#endif
254254
struct wolfBoot_image os_image;
255255
int pA_ver = 0, pB_ver = 0;
256+
uint32_t pA_ver_u = 0U, pB_ver_u = 0U;
256257
uint32_t cur_part = 0;
257258
int ret = -1;
258259
int selected;
259260
uint32_t *load_address;
260261
int failures = 0;
261262
uint32_t load_off;
263+
uint32_t max_ver;
262264
const uint8_t *hdr_ptr = NULL;
263265
#ifdef MMU
264266
uint8_t *dts_addr = NULL;
@@ -345,10 +347,16 @@ void RAMFUNCTION wolfBoot_start(void)
345347
wolfBoot_panic();
346348
}
347349

348-
wolfBoot_printf("Versions, A:%u B:%u\r\n", pA_ver, pB_ver);
350+
if (pA_ver > 0)
351+
pA_ver_u = (uint32_t)pA_ver;
352+
if (pB_ver > 0)
353+
pB_ver_u = (uint32_t)pB_ver;
354+
355+
wolfBoot_printf("Versions, A:%u B:%u\r\n", pA_ver_u, pB_ver_u);
356+
max_ver = (pB_ver_u > pA_ver_u) ? pB_ver_u : pA_ver_u;
349357

350358
/* Choose partition with higher version */
351-
selected = (pB_ver > pA_ver) ? 1: 0;
359+
selected = (pB_ver_u > pA_ver_u) ? 1 : 0;
352360

353361
#ifdef WOLFBOOT_FSP
354362
stage2_params = stage2_get_parameters();
@@ -368,6 +376,16 @@ void RAMFUNCTION wolfBoot_start(void)
368376
cur_part = BOOT_PART_B;
369377
else
370378
cur_part = BOOT_PART_A;
379+
#ifndef ALLOW_DOWNGRADE
380+
{
381+
uint32_t cur_ver = selected ? pB_ver_u : pA_ver_u;
382+
if ((max_ver > 0U) && (cur_ver < max_ver)) {
383+
wolfBoot_printf("Rollback to lower version not allowed\r\n");
384+
wolfBoot_panic();
385+
return;
386+
}
387+
}
388+
#endif
371389

372390
part_name[2] = 'A' + selected;
373391

@@ -498,6 +516,7 @@ void RAMFUNCTION wolfBoot_start(void)
498516
#endif
499517
wolfBoot_printf("Unable to find a valid partition!\r\n");
500518
wolfBoot_panic();
519+
return;
501520
}
502521

503522
disk_close(BOOT_DISK);

src/update_flash_hwswap.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include "hooks.h"
2929
#include "spi_flash.h"
3030
#include "wolfboot/wolfboot.h"
31+
#include "printf.h"
3132
#ifdef SECURE_PKCS11
3233
int WP11_Library_Init(void);
3334
#endif
@@ -45,12 +46,33 @@ void RAMFUNCTION wolfBoot_start(void)
4546
int active;
4647
struct wolfBoot_image fw_image;
4748
uint8_t p_state;
49+
#ifndef ALLOW_DOWNGRADE
50+
int boot_v_raw = (int)wolfBoot_current_firmware_version();
51+
int update_v_raw = (int)wolfBoot_update_firmware_version();
52+
uint32_t boot_v = 0U;
53+
uint32_t update_v = 0U;
54+
uint32_t max_v = (boot_v > update_v) ? boot_v : update_v;
55+
56+
if (boot_v_raw >= 0)
57+
boot_v = (uint32_t)boot_v_raw;
58+
if (update_v_raw >= 0)
59+
update_v = (uint32_t)update_v_raw;
60+
max_v = (boot_v > update_v) ? boot_v : update_v;
61+
#endif
4862
active = wolfBoot_dualboot_candidate();
4963

5064
if (active < 0) /* panic if no images available */
5165
boot_panic();
5266

5367
for (;;) {
68+
#ifndef ALLOW_DOWNGRADE
69+
uint32_t active_v = (active == PART_UPDATE) ? update_v : boot_v;
70+
if ((max_v > 0U) && (active_v < max_v)) {
71+
wolfBoot_printf("Rollback to lower version not allowed\n");
72+
boot_panic();
73+
return;
74+
}
75+
#endif
5476
if ((wolfBoot_open_image(&fw_image, active) < 0)
5577
#ifndef WOLFBOOT_SKIP_BOOT_VERIFY
5678
|| (wolfBoot_verify_integrity(&fw_image) < 0)

src/update_ram.c

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,19 @@ void RAMFUNCTION wolfBoot_start(void)
138138
uint8_t *dts_addr = NULL;
139139
uint32_t dts_size = 0;
140140
#endif
141+
#if !defined(ALLOW_DOWNGRADE) && defined(WOLFBOOT_FIXED_PARTITIONS)
142+
int boot_v_raw = (int)wolfBoot_current_firmware_version();
143+
int update_v_raw = (int)wolfBoot_update_firmware_version();
144+
uint32_t boot_v = 0U;
145+
uint32_t update_v = 0U;
146+
uint32_t max_v = 0U;
147+
148+
if (boot_v_raw >= 0)
149+
boot_v = (uint32_t)boot_v_raw;
150+
if (update_v_raw >= 0)
151+
update_v = (uint32_t)update_v_raw;
152+
max_v = (boot_v > update_v) ? boot_v : update_v;
153+
#endif /* !ALLOW_DOWNGRADE && WOLFBOOT_FIXED_PARTITIONS */
141154

142155
memset(&os_image, 0, sizeof(struct wolfBoot_image));
143156

@@ -162,6 +175,16 @@ void RAMFUNCTION wolfBoot_start(void)
162175
wolfBoot_panic();
163176
break;
164177
}
178+
#if !defined(ALLOW_DOWNGRADE) && defined(WOLFBOOT_FIXED_PARTITIONS)
179+
{
180+
uint32_t active_v = (active == PART_UPDATE) ? update_v : boot_v;
181+
if ((max_v > 0U) && (active_v < max_v)) {
182+
wolfBoot_printf("Rollback to lower version not allowed\n");
183+
wolfBoot_panic();
184+
break;
185+
}
186+
}
187+
#endif /* !ALLOW_DOWNGRADE && WOLFBOOT_FIXED_PARTITIONS */
165188

166189
#if defined(WOLFBOOT_DUALBOOT) && defined(WOLFBOOT_FIXED_PARTITIONS)
167190
wolfBoot_printf("Trying %s partition at %p\n",

tools/keytools/keygen.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -948,6 +948,7 @@ static void keygen_lms(const char *priv_fname, uint32_t id_mask)
948948
keystore_add(AUTH_KEY_LMS, lms_pub, KEYSTORE_PUBKEY_SIZE_LMS, priv_fname, id_mask);
949949

950950
wc_LmsKey_Free(&key);
951+
wc_ForceZero(&key, sizeof(key));
951952
}
952953

953954
#include "../xmss/xmss_common.h"
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
if [ ! -f ".config" ]; then
5+
echo "Missing .config. Run make config first." >&2
6+
exit 1
7+
fi
8+
9+
if ! grep -Eq '^(DUALBANK_SWAP(\?|)=1)' .config; then
10+
echo "DUALBANK_SWAP=1 is required for this simulation." >&2
11+
exit 1
12+
fi
13+
14+
if [ ! -x "./wolfboot.elf" ]; then
15+
echo "wolfboot.elf not found. Build the simulator first." >&2
16+
exit 1
17+
fi
18+
19+
if [ ! -f "./internal_flash.dd" ]; then
20+
echo "internal_flash.dd not found. Build test-sim-internal-flash-with-update first." >&2
21+
exit 1
22+
fi
23+
24+
backup_image="$(mktemp ./internal_flash.rollback.XXXXXX)"
25+
cp ./internal_flash.dd "$backup_image"
26+
trap 'cp "$backup_image" ./internal_flash.dd; rm -f "$backup_image" sim_registers.dd' EXIT
27+
28+
rm -f sim_registers.dd
29+
30+
update_addr_hex="$(grep '^WOLFBOOT_PARTITION_UPDATE_ADDRESS=' .config | cut -d= -f2)"
31+
if [ -z "${update_addr_hex}" ]; then
32+
echo "WOLFBOOT_PARTITION_UPDATE_ADDRESS is not set in .config." >&2
33+
exit 1
34+
fi
35+
36+
update_addr=$((update_addr_hex))
37+
38+
# Corrupt UPDATE payload bytes so version metadata remains intact but
39+
# image verification fails and boot logic attempts fallback.
40+
printf '\x00\x00\x00\x00\x00\x00\x00\x00' | \
41+
dd of=./internal_flash.dd bs=1 seek="$((update_addr + 0x120))" conv=notrunc status=none
42+
43+
set +e
44+
rollback_output="$(timeout 3s ./wolfboot.elf get_version 2>&1)"
45+
rollback_rc=$?
46+
set -e
47+
48+
if [ "$rollback_rc" -eq 0 ]; then
49+
echo "Expected rollback denial, but boot continued normally." >&2
50+
exit 1
51+
fi
52+
53+
if [ "$rollback_rc" -ne 124 ] && [ "$rollback_rc" -ne 80 ]; then
54+
echo "Unexpected exit code while checking rollback denial: $rollback_rc" >&2
55+
echo "$rollback_output" >&2
56+
exit 1
57+
fi
58+
59+
if ! printf '%s\n' "$rollback_output" | grep -q "Rollback to lower version not allowed"; then
60+
echo "Rollback denial message not found in output." >&2
61+
echo "$rollback_output" >&2
62+
exit 1
63+
fi
64+
65+
echo "Dualbank rollback-to-older-version denial verified."

tools/tpm/policy_create.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ int writeBin(const char* filename, const uint8_t*buf, word32 bufSz)
5454
XFILE fp = NULL;
5555
size_t fileSz = 0;
5656

57-
fp = XFOPEN(filename, "wt");
57+
fp = XFOPEN(filename, "wb");
5858
if (fp != XBADFILE) {
5959
fileSz = XFWRITE(buf, 1, bufSz, fp);
6060
/* sanity check */

tools/tpm/policy_sign.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,10 @@ static int PolicySign(int alg, const char* keyFile, byte* hash, word32 hashSz,
159159
rc = BAD_FUNC_ARG;
160160
}
161161

162-
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
162+
if (buf != NULL) {
163+
wc_ForceZero(buf, bufSz);
164+
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
165+
}
163166
wc_FreeRng(&rng);
164167

165168
if (rc != 0) {
@@ -221,7 +224,7 @@ static int writeBin(const char* filename, const byte *buf, word32 bufSz)
221224
FILE *fp = NULL;
222225
size_t fileSz = 0;
223226

224-
fp = fopen(filename, "wt");
227+
fp = fopen(filename, "wb");
225228
if (fp != NULL) {
226229
fileSz = fwrite(buf, 1, bufSz, fp);
227230
/* sanity check */

0 commit comments

Comments
 (0)