-
Notifications
You must be signed in to change notification settings - Fork 6.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing error check of function entropy_get_entropy() #29869
Labels
Comments
@Hxinrong would you mind sending a pull request for this? |
ceolin
pushed a commit
to ceolin/zephyr
that referenced
this issue
Nov 11, 2020
entropy_get_entropy return is not being checked what may result in a vulnerability because tc_ctr_prng_reseed will not get proper entropy data. Fixes zephyrproject-rtos#29869 Signed-off-by: Flavio Ceolin <[email protected]>
OK, thank you for your reply. Also, in the same file, seeing the following code, the return value of function tc_ctr_prng_reseed() is not checked before it is assigned by another function. zephyr/subsys/random/rand32_ctr_drbg.c Lines 136 to 148 in 577d588
|
MaureenHelm
pushed a commit
that referenced
this issue
Dec 1, 2020
entropy_get_entropy return is not being checked what may result in a vulnerability because tc_ctr_prng_reseed will not get proper entropy data. Fixes #29869 Signed-off-by: Flavio Ceolin <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Hi,
As described in the project API documentation, function entropy_get_entropy() fills a buffer with entropy, returns 0 on success, and returns -ERRNO on error. However, as shown in the following code, a missing error check take places.
zephyr/subsys/random/rand32_ctr_drbg.c
Lines 133 to 135 in 577d588
Furthermore, the return values of function entropy_get_entropy() from other call sites are all checked. See the following code which is from the same file, for example.
zephyr/subsys/random/rand32_ctr_drbg.c
Lines 85 to 90 in 577d588
The text was updated successfully, but these errors were encountered: