<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr"> <p style="margin-top:0;margin-bottom:0">I'm not so sure that CT-01-005 is an actual issue. Cure53 states the attacker could cause an OOB by writing (presumably meaning passing this in) a negative value for <i>attributes_len.</i></p> <ol style="margin-bottom: 0px; margin-top: 0px;"> <li><i>attributes_len</i> is set by calling <span>hal_xdr_decode_int, it is not passed into <span>pkey_get_attributes. it's true that <i>attributes_len </i> is passed back in hal_xdr_decode_int via <span style="background-color: rgb(255, 255, 0);">*value = ntohl(**(uint32_t **)inbuf);<span style="background-color: rgb(255, 255, 255);"> but this is not the same sitaution as CT-01-006</span><span style="background-color: rgb(255, 255, 255);"></span></span></span></span></li><li><span><span>hal_xdr_decode has a buffer overflow check and the conditional check is unsigned, therefore a signed value buffer overflow attack is not possile in my sing opinion. using arm-non-eabi-objdump we see the conditonal check is b.n without a cmp to set the cc.<br> </span></span> <ol> <li><span><span> <div>/* buffer overflow check */<br> if (limit - *inbuf < (ptrdiff_t)sizeof(*value))<br> 56: 2001 movs r0, #1<br> 58: e001 b.n 5e <hal_xdr_decode_buffer_in_place+0x5e><br> 5a: 2001 movs r0, #1<br> return HAL_ERROR_XDR_BUFFER_OVERFLOW;</div> <br> </span></span></li></ol> </li></ol> </div> <hr style="display:inline-block;width:98%" tabindex="-1"> <div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Tech <tech-bounces@cryptech.is> on behalf of Phil Roberts <roberts@dkey.org><br> <b>Sent:</b> Tuesday, October 9, 2018 7:37:03 AM<br> <b>To:</b> tech@cryptech.is<br> <b>Subject:</b> [Cryptech Tech] Cure53 security audit</font> <div> </div> </div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt;"> <div class="PlainText"><br> Hi folks,<br> <br> Cure53 completed a security audit for us last month. The Cryptech core team has begun updating the design and implemention<br> in accordance with the recommendations in the audit report. Furthermore, the core team is reviewing and updating our development process and how to augument the toolchain to ensure that an even higher, and more consistent quality<br> and level of security will be reached. It is expected that there will be<br> incremental updates to address the identified issues, and these will be finished by the end of year.<br> <br> Regards,<br> Phil<br> <br> <br> <br> </div> </span></font></div> </body> </html>