Fix: WolfCrypt Fenrir - 11 fixes

[aidankeefe2022]

Description

https://fenrir.wolfssl.com/finding/6145

wc_DsaVerify/wc_DsaVerify_ex leave *answer uninitialized on all error paths, unlike sibling ECC/ECCSI verify APIs that default to "not verified".

• Initialized the answer parameter to zero so that on early exit the output parameter is defined as false.

https://fenrir.wolfssl.com/finding/4432

wc_DrbgState_MutexInit unsafe lazy mutex initialization without WOLFSSL_MUTEX_INITIALIZER.

• Won't fix callers are expected to call this in single threaded wolfCrypt_Init protects its self from race conditions with its atomic state machine. Added documentation to problem mutex init and free functions.

https://fenrir.wolfssl.com/finding/5392

DES key schedule branches on secret key bits.

• Instead of an if statement, we use a mask to set bits in ks.

https://fenrir.wolfssl.com/finding/5994

Invalid free / use-after-free of embedded X509 NAME in the ESP32 cert-bundle verify callback on a lookup miss.

• Confirmed and removed the double free in esp_crt_bundle.c.

https://fenrir.wolfssl.com/finding/4445

devcrypto wc_Sha256Copy produces a non-functional hash copy when WOLFSSL_DEVCRYPTO_HASH_KEEP is disabled.

• Made the function match the rest of the file and return an error when a copy is not available. Also freed the destination before the copy to fix a memory leak.

https://fenrir.wolfssl.com/finding/4446

devcrypto wc_Sha256Final leaks the kernel hash session when GetDigest fails.

• Added a free on error, which uncovered and fixed memory leaks caught by tests when devcrypto is enabled.

https://fenrir.wolfssl.com/finding/5418

FSPSM AES-GCM TLS key allocation failures return without unlocking hardware.

• Added a mutex unlock on memory allocation failure.

https://fenrir.wolfssl.com/finding/5420

FSPSM hash Final/GetHash silently succeeds when hardware hash initialization fails.

• Set ret to an error value so that on return the error is no longer silent.

https://fenrir.wolfssl.com/finding/5411

SipHash assembly paths load the caller key through word64 pointer casts.

• Swapped multiple byte* to word64* casts to use the GET_U64() helper macro to protect against alignment issues.

https://fenrir.wolfssl.com/finding/5412

Intel RDSEED/RDRAND generators write arbitrary output buffers as word64.

• Added a temporary word64 value, then used writeUnalignedWord64 to transfer it into the output without alignment issues.

https://fenrir.wolfssl.com/finding/5413

ML-KEM AArch64 noise helpers cast byte buffers and seeds to word64 pointers.

• Used the alignment-protected helper function writeUnalignedWord64 instead of a byte* -> word64* cast.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 201,239 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 175,250 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +128 B, .text +64 B (+0.0%, 773,036 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 214,038 B / 262,144 B, total: 82% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +128 B (+0.0%, 281,216 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +136 B (+0.0%, 327,328 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 237,385 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 201,239 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +128 B (+0.0%, 281,792 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +122 B (+0.1%, 237,449 B / 262,144 B, total: 91% used)

linuxkm-standard

• Data: __patchable_function_entries -40 B (-0.1%, 49,184 B)

stm32-sim-stm32h753

• FLASH: .text +132 B (+0.1%, 185,816 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• linuxkm-pie

[aidankeefe2022]

Jenkins retest this please

[aidankeefe2022]

Jenkins retest this please

[aidankeefe2022]

Jenkins retest this please

[aidankeefe2022]

Jenkins retest this please

[aidankeefe2022]

rebased branch on to master

[Frauschi]

Jenkins retest this please.

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 2 total — 2 posted, 0 skipped

Posted findings

• [High] wc_Sha256Copy frees a zero-initialized dst and closes fd 0 (devcrypto) — wolfcrypt/src/port/devcrypto/devcrypto_hash.c:231
• [Medium] wc_Sha256Copy leaks the just-opened session on XMALLOC failure — wolfcrypt/src/port/devcrypto/devcrypto_hash.c:238-241

Review generated by Skoll via Claude/Codex

[dgarske]

#10786 (review)

[aidankeefe2022]

There is a lot of issues that come with trying to make the mutex initializer thread safe. I am now in favor of removing this goal and instead asking the user to init the mutex from a single thread. Using pthreads initializing a mutex (at runtime) concurrently will cause a race condition so there is precedence for this. I am going to remove WOLFSSL_THREAD_YEILD and set the mutex back to its original version.

I am adding documentation to make this clear

[aidankeefe2022]

As for this finding devcrypto AES-GCM out-of-bounds writes are masked by enlarging the unit-test buffer rather than fixed

This is intended behavior from the original writer of this functionality. The issue was that the test buffer was not written with this in mind.

[aidankeefe2022]

Retest this please