Skip to content

Fix fenrir security findings for wolfcrypt #9830

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JacobBarthelmeh merged 1 commit into from
Feb 26, 2026
Merged

Fix fenrir security findings for wolfcrypt #9830

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions wolfcrypt/src/aes.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14643,7 +14643,7 @@ int wc_AesKeyUnWrap_ex(Aes *aes, const byte* in, word32 inSz, byte* out,
return ret;

/* verify IV */
if (XMEMCMP(tmp, expIv, KEYWRAP_BLOCK_SIZE) != 0)
if (ConstantCompare(tmp, expIv, KEYWRAP_BLOCK_SIZE) != 0)
return BAD_KEYWRAP_IV_E;

return (int)(inSz - KEYWRAP_BLOCK_SIZE);
Expand Down Expand Up @@ -16303,7 +16303,7 @@ static WARN_UNUSED_RESULT int AesSivCipher(
WOLFSSL_MSG("S2V failed.");
}

if (XMEMCMP(siv, sivTmp, WC_AES_BLOCK_SIZE) != 0) {
if (ConstantCompare(siv, sivTmp, WC_AES_BLOCK_SIZE) != 0) {
WOLFSSL_MSG("Computed SIV doesn't match received SIV.");
ret = AES_SIV_AUTH_E;
}
Expand Down
2 changes: 1 addition & 1 deletion wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,7 +487,7 @@ static word32 SizeASNLength(word32 length)
#define ALLOC_ASNSETDATA(name, cnt, err, heap) \
do { \
if ((err) == 0) { \
(name) = (ASNSetData*)XMALLOC(sizeof(ASNGetData) * (cnt), (heap), \
(name) = (ASNSetData*)XMALLOC(sizeof(ASNSetData) * (cnt), (heap), \
DYNAMIC_TYPE_TMP_BUFFER); \
if ((name) == NULL) { \
(err) = MEMORY_E; \
Expand Down
17 changes: 12 additions & 5 deletions wolfcrypt/src/chacha20_poly1305.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,8 @@ int wc_ChaCha20Poly1305_Init(ChaChaPoly_Aead* aead,
aead->state = CHACHA20_POLY1305_STATE_READY;
}

ForceZero(authKey, sizeof(authKey));

return ret;
}

Expand Down Expand Up @@ -332,25 +334,30 @@ int wc_XChaCha20Poly1305_Init(
/* Create the Poly1305 key */
if ((ret = wc_Chacha_Process(&aead->chacha, authKey, authKey,
(word32)sizeof authKey)) < 0)
return ret;
goto out;
/* advance to start of the next ChaCha block. */
wc_Chacha_purge_current_block(&aead->chacha);

/* Initialize Poly1305 context */
if ((ret = wc_Poly1305SetKey(&aead->poly, authKey,
(word32)sizeof authKey)) < 0)
return ret;
goto out;

if ((ret = wc_Poly1305Update(&aead->poly, ad, (word32)ad_len)) < 0)
return ret;
goto out;

if ((ret = wc_Poly1305_Pad(&aead->poly, (word32)ad_len)) < 0)
return ret;
goto out;

aead->isEncrypt = isEncrypt ? 1 : 0;
aead->state = CHACHA20_POLY1305_STATE_AAD;

return 0;
ret = 0;

out:
ForceZero(authKey, sizeof(authKey));

return ret;
}

static WC_INLINE int wc_XChaCha20Poly1305_crypt_oneshot(
Expand Down
8 changes: 6 additions & 2 deletions wolfcrypt/src/ecc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14484,6 +14484,8 @@ int wc_ecc_encrypt_ex(ecc_key* privKey, ecc_key* pubKey, const byte* msg,

RESTORE_VECTOR_REGISTERS();

ForceZero(sharedSecret, sharedSz);
ForceZero(keys, (word32)keysLen);
WC_FREE_VAR_EX(sharedSecret, ctx->heap, DYNAMIC_TYPE_ECC_BUFFER);
WC_FREE_VAR_EX(keys, ctx->heap, DYNAMIC_TYPE_ECC_BUFFER);

Expand Down Expand Up @@ -14778,8 +14780,8 @@ int wc_ecc_decrypt(ecc_key* privKey, ecc_key* pubKey, const byte* msg,

if (ret == 0)
ret = wc_HmacFinal(hmac, verify);
if ((ret == 0) && (XMEMCMP(verify, msg + msgSz - digestSz,
digestSz) != 0)) {
if ((ret == 0) && (ConstantCompare(verify, msg + msgSz - digestSz,
(int)digestSz) != 0)) {
ret = HASH_TYPE_E;
WOLFSSL_MSG("ECC Decrypt HMAC Check failed!");
}
Expand Down Expand Up @@ -14882,6 +14884,8 @@ int wc_ecc_decrypt(ecc_key* privKey, ecc_key* pubKey, const byte* msg,
if (pubKey == peerKey)
wc_ecc_free(peerKey);
#endif
ForceZero(sharedSecret, sharedSz);
ForceZero(keys, (word32)keysLen);
#ifdef WOLFSSL_SMALL_STACK
#ifndef WOLFSSL_ECIES_OLD
XFREE(peerKey, ctx->heap, DYNAMIC_TYPE_ECC_BUFFER);
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/src/evp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4952,7 +4952,7 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,

hashLen = wolfssl_mac_len(ctx->hash.hmac.macType);

if (siglen > hashLen)
if (siglen > hashLen || siglen > INT_MAX)
return WOLFSSL_FAILURE;
/* May be a truncated signature. */
}
Expand All @@ -4962,7 +4962,7 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,

if (ctx->isHMAC) {
/* Check HMAC result matches the signature. */
if (XMEMCMP(sig, digest, (size_t)siglen) == 0)
if (ConstantCompare(sig, digest, (int)siglen) == 0)
Comment thread
aidangarske marked this conversation as resolved.
Comment thread
aidangarske marked this conversation as resolved.
return WOLFSSL_SUCCESS;
return WOLFSSL_FAILURE;
}
Expand Down
11 changes: 11 additions & 0 deletions wolfcrypt/src/hpke.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -796,6 +796,8 @@ static int wc_HpkeEncap(Hpke* hpke, void* ephemeralKey, void* receiverKey,
hpke->Npk * 2, sharedSecret);
}

ForceZero(dh, hpke->Ndh);
ForceZero(kemContext, hpke->Npk * 2);
WC_FREE_VAR_EX(dh, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);
WC_FREE_VAR_EX(kemContext, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

Expand All @@ -816,6 +818,9 @@ static int wc_HpkeSetupBaseSender(Hpke* hpke, HpkeBaseContext* context,
#ifdef WOLFSSL_SMALL_STACK
sharedSecret = (byte*)XMALLOC(hpke->Nsecret, hpke->heap,
DYNAMIC_TYPE_TMP_BUFFER);
if (sharedSecret == NULL) {
return MEMORY_E;
}
#endif

/* encap */
Expand All @@ -827,6 +832,7 @@ static int wc_HpkeSetupBaseSender(Hpke* hpke, HpkeBaseContext* context,
infoSz);
}

ForceZero(sharedSecret, hpke->Nsecret);
WC_FREE_VAR_EX(sharedSecret, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

return ret;
Expand Down Expand Up @@ -914,6 +920,7 @@ int wc_HpkeSealBase(Hpke* hpke, void* ephemeralKey, void* receiverKey,

PRIVATE_KEY_LOCK();

ForceZero(context, sizeof(HpkeBaseContext));
WC_FREE_VAR_EX(context, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

return ret;
Expand Down Expand Up @@ -1032,6 +1039,8 @@ static int wc_HpkeDecap(Hpke* hpke, void* receiverKey, const byte* pubKey,
hpke->Npk * 2, sharedSecret);
}

ForceZero(dh, hpke->Ndh);
ForceZero(kemContext, hpke->Npk * 2);
WC_FREE_VAR_EX(dh, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);
Comment thread
aidangarske marked this conversation as resolved.
WC_FREE_VAR_EX(kemContext, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

Expand All @@ -1058,6 +1067,7 @@ static int wc_HpkeSetupBaseReceiver(Hpke* hpke, HpkeBaseContext* context,
infoSz);
}

ForceZero(sharedSecret, hpke->Nsecret);
WC_FREE_VAR_EX(sharedSecret, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

return ret;
Expand Down Expand Up @@ -1144,6 +1154,7 @@ int wc_HpkeOpenBase(Hpke* hpke, void* receiverKey, const byte* pubKey,

PRIVATE_KEY_LOCK();

ForceZero(context, sizeof(HpkeBaseContext));
WC_FREE_VAR_EX(context, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);

return ret;
Expand Down
8 changes: 7 additions & 1 deletion wolfcrypt/src/pkcs12.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,13 @@ static int wc_PKCS12_verify(WC_PKCS12* pkcs12, byte* data, word32 dataSz,
}
#endif

return XMEMCMP(digest, mac->digest, mac->digestSz);
if (ConstantCompare(digest, mac->digest, (int)mac->digestSz) != 0) {
ForceZero(digest, sizeof(digest));
return MAC_CMP_FAILED_E;
}

ForceZero(digest, sizeof(digest));
return 0;
}

int wc_PKCS12_verify_ex(WC_PKCS12* pkcs12, const byte* psw, word32 pswSz)
Expand Down
3 changes: 3 additions & 0 deletions wolfcrypt/src/pwdbased.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,8 @@ int wc_PBKDF1_ex(byte* key, int keyLen, byte* iv, int ivLen,

WC_FREE_VAR_EX(hash, heap, DYNAMIC_TYPE_HASHCTX);

ForceZero(digest, sizeof(digest));

if (err != 0)
return err;

Expand Down Expand Up @@ -294,6 +296,7 @@ int wc_PBKDF2_ex(byte* output, const byte* passwd, int pLen, const byte* salt,
wc_HmacFree(hmac);
}

ForceZero(buffer, (word32)hLen);
WC_FREE_VAR_EX(buffer, heap, DYNAMIC_TYPE_TMP_BUFFER);
WC_FREE_VAR_EX(hmac, heap, DYNAMIC_TYPE_HMAC);

Expand Down
3 changes: 2 additions & 1 deletion wolfcrypt/src/sakke.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6941,7 +6941,8 @@ int wc_DeriveSakkeSSV(SakkeKey* key, enum wc_HashType hashType, byte* ssv,

err = sakke_compute_point_r(key, key->id, key->idSz, ri, n, test);
}
if ((err == 0) && (XMEMCMP(auth, test, (size_t)(2 * n + 1)) != 0)) {
/* n is word16, so 2*n+1 always fits in int */
if ((err == 0) && (ConstantCompare(auth, test, (int)(2 * n + 1)) != 0)) {
Comment thread
aidangarske marked this conversation as resolved.
err = SAKKE_VERIFY_FAIL_E;
}

Expand Down
6 changes: 4 additions & 2 deletions wolfcrypt/src/srp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -982,7 +982,7 @@ int wc_SrpVerifyPeersProof(Srp* srp, byte* proof, word32 size)
if (hashSize < 0)
return ALGO_ID_E;

if (size != (word32)hashSize)
if (size != (word32)hashSize || size > INT_MAX)
return BUFFER_E;

r = SrpHashFinal(srp->side == SRP_CLIENT_SIDE ? &srp->server_proof
Expand All @@ -994,9 +994,11 @@ int wc_SrpVerifyPeersProof(Srp* srp, byte* proof, word32 size)
if (!r) r = SrpHashUpdate(&srp->server_proof, srp->key, srp->keySz);
}

if (!r && XMEMCMP(proof, digest, size) != 0)
if (!r && ConstantCompare(proof, digest, (int)size) != 0)
Comment thread
aidangarske marked this conversation as resolved.
r = SRP_VERIFY_E;

ForceZero(digest, sizeof(digest));

return r;
}

Expand Down
5 changes: 5 additions & 0 deletions wolfcrypt/src/wc_mlkem.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1205,6 +1205,8 @@ int wc_MlKemKey_EncapsulateWithRandom(MlKemKey* key, unsigned char* c,
}
#endif

ForceZero(kr, sizeof(kr));

return ret;
}
#endif /* !WOLFSSL_MLKEM_NO_ENCAPSULATE */
Expand Down Expand Up @@ -1541,6 +1543,9 @@ int wc_MlKemKey_Decapsulate(MlKemKey* key, unsigned char* ss,
}
#endif

ForceZero(msg, sizeof(msg));
ForceZero(kr, sizeof(kr));

return ret;
}
#endif /* WOLFSSL_MLKEM_NO_DECAPSULATE */
Expand Down
Loading