From 398d9ea9cd02d3f612ee3554d9fb56ea5ca8e3ef Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Sat, 28 Feb 2026 11:02:13 +0530 Subject: [PATCH] fix(esp_security): Add more validation checks --- components/esp_security/include/esp_ds.h | 1 + components/esp_security/src/esp_key_mgr.c | 5 +++++ .../esp_tee/subproject/main/core/esp_secure_services.c | 4 ++++ 3 files changed, 10 insertions(+) diff --git a/components/esp_security/include/esp_ds.h b/components/esp_security/include/esp_ds.h index c2bdf7713de..dbc23bb44ce 100644 --- a/components/esp_security/include/esp_ds.h +++ b/components/esp_security/include/esp_ds.h @@ -27,6 +27,7 @@ extern "C" { #define ESP_DS_SIGNATURE_M_PRIME_BIT_LEN 32 #define ESP_DS_SIGNATURE_L_BIT_LEN 32 #define ESP_DS_SIGNATURE_PADDING_BIT_LEN 64 +#define ESP_DS_DATA_KEY_SIZE 32 /* Length of parameter 'C' stored in flash, in bytes - Operands Y, M and r_bar; each equal to maximum RSA bit length diff --git a/components/esp_security/src/esp_key_mgr.c b/components/esp_security/src/esp_key_mgr.c index 28bcfbedba0..786050cad67 100644 --- a/components/esp_security/src/esp_key_mgr.c +++ b/components/esp_security/src/esp_key_mgr.c @@ -561,6 +561,11 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery return ESP_ERR_INVALID_ARG; } + if (key_recovery_info->magic != KEY_HUK_SECTOR_MAGIC) { + ESP_LOGE(TAG, "Invalid key recovery info magic"); + return ESP_ERR_INVALID_ARG; + } + esp_key_mgr_key_type_t key_type = key_recovery_info->key_type; ESP_LOGD(TAG, "Activating key of type %d", key_type); diff --git a/components/esp_tee/subproject/main/core/esp_secure_services.c b/components/esp_tee/subproject/main/core/esp_secure_services.c index c3a0ad675d9..13d53db7ad3 100644 --- a/components/esp_tee/subproject/main/core/esp_secure_services.c +++ b/components/esp_tee/subproject/main/core/esp_secure_services.c @@ -347,6 +347,8 @@ esp_err_t _ss_esp_ds_encrypt_params(esp_ds_data_t *data, (esp_tee_ptr_in_ree((void *)iv) && esp_tee_ptr_in_ree((void *)key))); valid_addr &= esp_tee_ptr_in_ree((void *)((char *)data + sizeof(esp_ds_data_t))); + valid_addr &= esp_tee_ptr_in_ree((void *)((char *)p_data + sizeof(esp_ds_p_data_t))); + valid_addr &= esp_tee_ptr_in_ree((void *)((char *)key + ESP_DS_DATA_KEY_SIZE)); if (!valid_addr) { return ESP_ERR_INVALID_ARG; @@ -366,6 +368,8 @@ esp_err_t _ss_esp_ds_encrypt_params_using_key_type(esp_ds_data_t *data, (esp_tee_ptr_in_ree((void *)iv) && esp_tee_ptr_in_ree((void *)key))); valid_addr &= esp_tee_ptr_in_ree((void *)((char *)data + sizeof(esp_ds_data_t))); + valid_addr &= esp_tee_ptr_in_ree((void *)((char *)p_data + sizeof(esp_ds_p_data_t))); + valid_addr &= esp_tee_ptr_in_ree((void *)((char *)key + ESP_DS_DATA_KEY_SIZE)); if (!valid_addr) { return ESP_ERR_INVALID_ARG;