Aditya Patwardhan dcb758a30b fix(esp_tee): prevent validation clobbering and deref-before-check ...

TEE secure-service handlers had two bugs letting REE bypass
pointer-region validation:

1. valid_addr = instead of valid_addr &= in AEAD encrypt/decrypt
   and DS sign handlers, clobbering prior failed checks.
   Impact: REE writes to TEE DRAM via DS signature output, or reads
   TEE DRAM via AEAD output.

2. data->rsa_length dereferenced before data is validated in DS sign
   and DS start_sign handlers.

Fix: use &= for subsequent checks, add early return after initial
data pointer check in DS handlers.

2026-04-30 10:18:00 +05:30

..

components

fix(esp_tee): Add missing input validation checks for TEE service calls

2026-04-09 16:34:21 +05:30

main

fix(esp_tee): prevent validation clobbering and deref-before-check

2026-04-30 10:18:00 +05:30

CMakeLists.txt

fix(esp_tee): build esp_tee only with CONFIG_LIBC_NEWLIB to reduce size

2026-02-02 12:27:27 +07:00