fix(nxp-crypto): restricts generating nxp_mkvb via ns-world
Master-key-verification-blob (MKVB) value generated on request from
the secure world, is same to the MKVB value generated on request from
Normal world. Leading to the leak og MKVB to non-secure world.
Fix to prevent MKVB generation for requests originating from non-secure
world.
- For non-secure world, this SMC is return failure.
Additional fix for bound-check before continuing to generate the MKVB.
Change-Id: I9940b4dfe33289c2d57595a2a08acff29a12c974
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
diff --git a/drivers/nxp/crypto/caam/src/hw_key_blob.c b/drivers/nxp/crypto/caam/src/hw_key_blob.c
index 6bcb6ba..0ac750d 100644
--- a/drivers/nxp/crypto/caam/src/hw_key_blob.c
+++ b/drivers/nxp/crypto/caam/src/hw_key_blob.c
@@ -43,6 +43,10 @@
struct job_descriptor *jobdesc = &desc;
uint32_t in_sz = 16U;
+ if (size <= 0 || size > 16) {
+ ERROR("Error: Requested invalid length of HUK.\n");
+ return -1;
+ }
/* Output blob will have 32 bytes key blob in beginning and
* 16 byte HMAC identifier at end of data blob
*/
diff --git a/plat/nxp/common/sip_svc/sip_svc.c b/plat/nxp/common/sip_svc/sip_svc.c
index 1c8668e..4eec0ac 100644
--- a/plat/nxp/common/sip_svc/sip_svc.c
+++ b/plat/nxp/common/sip_svc/sip_svc.c
@@ -100,7 +100,7 @@
}
/* break is not required as SMC_RETx return */
case SIP_SVC_HUK:
- if (is_sec_enabled() == false) {
+ if (ns != 0 || is_sec_enabled() == false) {
NOTICE("SEC is disabled.\n");
SMC_RET1(handle, SMC_UNK);
}