Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

nuttx/drivers/crypto/pnt/pnt_se05x_api: Minor Overflow in Secure Element

Browse source 
Driver May Cause a DoS

Invalid data is passed to the NXP Plug & Trust Nano Package used by the
NuttX secure element driver. If the NXP code is not handling the malformed
data, a corruption can occur. Alternatively, if the attacker is able to
point create_signature_args->algorithm in memory at an address that is not
accessible, a crash can occur.

Applicable to:
* `signature_algorithm_mapping[create_signature_args->algorithm]`
* `signature_algorithm_mapping[verify_signature_args->algorithm]`

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-06-27 00:43:59 -04:00 • committed by Xiang Xiao
parent a923e4a714
commit 6f74205b42
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/crypto/pnt/pnt_se05x_api.c
View file

@ -308,6 +308,12 @@ int pnt_se05x_create_signature(
{
create_signature_args->signature.buffer_content_size =
create_signature_args->signature.buffer_size;
if (create_signature_args->algorithm >= SE05X_ALGORITHM_SIZE)
{
return -EINVAL;
}
int result =
Se05x_API_ECDSASign(
&(se05x->pnt->session), create_signature_args->key_id,
@ -327,6 +333,12 @@ int pnt_se05x_verify_signature(
FAR struct se05x_signature_s *verify_signature_args)
{
SE05x_Result_t se05x_result;
if (verify_signature_args->algorithm >= SE05X_ALGORITHM_SIZE)
{
return -EINVAL;
}
int result =
Se05x_API_ECDSAVerify(
&(se05x->pnt->session), verify_signature_args->key_id,