vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

image-fit-sig: Validate hashed-strings region size

Browse Source 
fit_config_check_sig() reads the hashed-strings property and uses
its size value without validation when building the region list for
signature verification. A crafted FIT image can specify an arbitrary
size, causing the hash calculation to read beyond the end of the FIT
image. The property length is also not checked, so a truncated
hashed-strings property causes strings[1] to be read past the end of
the property. This may result in the out-of-bounds read during signature
verification of an untrusted FIT.

Validate both the property length and that the declared strings region
fits within bounds before adding it to the region list.

Signed-off-by: Anton Ivanov <anton@binarly.io>
This commit is contained in:
Anton Ivanov
2026-06-12 15:35:54 -06:00
committed by Tom Rini
parent 7e47c37adf
commit e733286125
2 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/py/tests/test_vboot.py
+26
View File
@@ -415,6 +415,32 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
ubman, [fit_check_sign, '-f', fit, '-k', dtb],
1, 'Failed to verify required signature')
# Create a new properly signed fit and replace hashed-strings
# size property
make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit(sha_algo, sign_options)
utils.run_and_log(ubman, 'fdtput -t x %s %s hashed-strings 0' %
(fit, sig_node))
run_bootm(sha_algo, 'Signed config with truncated hashed-strings',
'Invalid hashed-strings property', False)
ubman.log.action('%s: Check truncated hashed-strings property' % sha_algo)
# size_dt_strings is at offset 32 in the FDT header
with open(fit, 'rb') as handle:
handle.seek(32)
size_dt_strings = struct.unpack(">I", handle.read(4))[0]
utils.run_and_log(ubman, 'fdtput -t x %s %s hashed-strings 0 %#x' %
(fit, sig_node, size_dt_strings + 1))
run_bootm(sha_algo, 'Signed config with overflowed hashed-strings size',
'Strings region is out of bounds', False)
ubman.log.action('%s: Check overflowed hashed-strings size' % sha_algo)
utils.run_and_log(ubman, 'fdtput -t x %s %s hashed-strings 0 %#x' %
(fit, sig_node, size_dt_strings))
run_bootm(sha_algo, 'Signed config with in-bounds hashed-strings size',
'Bad Data Hash', False)
ubman.log.action('%s: Check in-bounds hashed-strings size' % sha_algo)
def test_required_key(sha_algo, padding, sign_options):
"""Test verified boot with the given hash algorithm.