handle_session_command0() freed cur_session->srp_hd on every error path
without clearing the pointer. A subsequent sec2_close_session() call
(e.g. on BLE disconnect, or via sec2_new_session evicting the old
session) checks `if (cur_session->srp_hd)` and frees it again,
double-freeing a dangling pointer.
Add checks to validate client_verify_data pointer and length before
processing in handle_session_command1. Prevents NULL pointer dereference
when client omits verifier data in Session_Command1, which could cause
device crash during provisioning (remote DoS attack).
We would like to thank Pavel Kohout from Aisle Research for reporting
this vulnerability along with a mitigation strategy.
Change default values for protocomm security configuration options to improve
security:
- CONFIG_ESP_PROTOCOMM_SUPPORT_SECURITY_VERSION_0 now defaults to 'n'
- CONFIG_ESP_PROTOCOMM_SUPPORT_SECURITY_VERSION_1 now defaults to 'n'
This reduces code size by default and encourages use of more secure protocomm
implementations.
Projects using these security versions must explicitly enable them in their
configuration.
Using same IV in AES-GCM across multiple invocation of
encryption/decryption operations can pose a security risk. It can help
to reveal co-relation between different plaintexts.
This commit introduces a change to use part of IV as a monotonic
counter, which must be incremented after every AES-GCM invocation
on both the client and the device side.
Concept of patch version for a security scheme has been introduced here
which can help to differentiate a protocol behavior for the provisioning
entity. The security patch version will be available in the JSON
response for `proto-ver` endpoint request with the field
`sec_patch_ver`.
Please refer to documentation for more details on the changes required
on the provisioning entity side (e.g., PhoneApps).
fix(nt/bluedroid): Split the device name set functions
feat(bt/bluedroid): added APIs to get/set device name on BT GAP side
change(bt/common): Marked some APIs in device module as deprecated
1. esp_bt_dev_set_device_name
2. esp_bt_dev_get_device_name
change(bt/bluedroid): use BT GAP APIs to set/get device name in bluetooth classic examples
change(bt/bluedroid): use BT/BLE GAP APIs to set/get device name in coexist examples
Jim
Mahavir Jain
Ashish Sharma
Jiang Jiang Jian
Alexey Lapshin
Rahul Tank
harshal.patil
Aditya Patwardhan
WanqQixiang
Wang Meng Yang
Marek Fiala
gongyantao
Marius Vikhammer
Shen Meng Jing
Chen Jichang
igor.udot
gaoxu
hrushikesh.bhosale
Ivan Grokhotkov
shreeyash
wanlei
zhiweijian
laokaiyao