Fix STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076) - #11102
Open
dgarske wants to merge 1 commit into
Open
Fix STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076)#11102dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Mitigates an STM32Cube HAL CRYP AES-GCM issue (ST SA0076) where AAD can be over-read due to HAL performing trailing 32-bit word reads, by ensuring the AAD buffer provided to HAL is word-padded without altering the GHASH length reported to the peripheral.
Changes:
- Introduces
STM_CRYPT_HEADER_PAD_WIDTHto express the HAL’s word read/pad granularity (default 4 bytes). - Updates STM32 AES-GCM encrypt/decrypt paths to allocate/copy a zero-padded AAD buffer sized to a word boundary while keeping the HAL-reported AAD length unchanged.
- Adds cleanup to avoid leaking the allocated AAD buffer when the HW mutex lock fails.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| wolfssl/wolfcrypt/port/st/stm32.h | Adds a configurable pad-width macro for STM32 HAL AAD word-padding behavior. |
| wolfcrypt/src/aes.c | Pads AAD buffers up to word size for STM32 AES-GCM, and frees temp buffers on mutex-lock failure. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+11613
to
+11625
| /* The HAL reads the auth header a word at a time, including the trailing | ||
| * partial word, so the buffer handed to it has to be zero padded up to a | ||
| * word. authPadSz stays the length reported to the HAL, so the GHASH | ||
| * length block, and with it the hardware tag, does not change. */ | ||
| authBufSz = authPadSz; | ||
| if (authBufSz < authInSz) { | ||
| authBufSz = authInSz; | ||
| } | ||
| if ((authBufSz % STM_CRYPT_HEADER_PAD_WIDTH) != 0) { | ||
| authBufSz += STM_CRYPT_HEADER_PAD_WIDTH - | ||
| (authBufSz % STM_CRYPT_HEADER_PAD_WIDTH); | ||
| } | ||
| if (authBufSz != authInSz) { |
Comment on lines
+10760
to
+10771
| /* The HAL reads the auth header a word at a time, including the trailing | ||
| * partial word, so the buffer handed to it has to be zero padded up to a | ||
| * word. authPadSz stays the length reported to the HAL, so the GHASH | ||
| * length block, and with it the hardware tag, does not change. */ | ||
| authBufSz = authPadSz; | ||
| if (authBufSz < authInSz) { | ||
| authBufSz = authInSz; | ||
| } | ||
| if ((authBufSz % STM_CRYPT_HEADER_PAD_WIDTH) != 0) { | ||
| authBufSz += STM_CRYPT_HEADER_PAD_WIDTH - | ||
| (authBufSz % STM_CRYPT_HEADER_PAD_WIDTH); | ||
| } |
Comment on lines
+784
to
+786
| #ifndef STM_CRYPT_HEADER_PAD_WIDTH | ||
| #define STM_CRYPT_HEADER_PAD_WIDTH 4 | ||
| #endif |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076)
This fix mitigates an issue in the STM32Cube HAL CRYP driver (fixed in CubeU5 1.9.0 / HAL CRYP v1.6.3)
Fixes ZD 22274
Testing
Validated on hardware (NUCLEO-U385RG-Q with the CubeMX HAL crypto driver): AES-GCM known-answer tests with no AAD, 20-byte, 13-byte and 5-byte AAD all pass, byte-identical before and after the change.
Checklist