Skip to content

libckteec: fix NULL dereferences, overflow, and thread-safety in PKCS#11 serialization #419

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jenswikl merged 4 commits into from
Jun 2, 2026
Merged

libckteec: fix NULL dereferences, overflow, and thread-safety in PKCS#11 serialization #419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
29e7073
libckteec: fix NULL pointer dereferences in PKCS#11 serialization
manoj23 Apr 15, 2026
0ceb997
libckteec: add data pointer validation in serialize()
manoj23 Apr 15, 2026
0cd8b36
libckteec: add integer overflow guard in serialize_mecha_aes_cbc_encr…
manoj23 May 18, 2026
877d082
libckteec: replace strerror with strerror_r in invoke_ta.c
manoj23 May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions libckteec/src/invoke_ta.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
#include <pthread.h>
#include <stdlib.h>
#include <string.h>

#define STRERROR_BUF_SIZE 128
#include <sys/types.h>
#include <tee_client_api.h>
#include <teec_trace.h>
Expand Down Expand Up @@ -319,7 +321,11 @@ CK_RV ckteec_invoke_init(void)
out:
e = pthread_mutex_unlock(&ta_ctx.init_mutex);
if (e) {
EMSG("pthread_mutex_unlock: %s", strerror(e));
char errbuf[STRERROR_BUF_SIZE];

if (strerror_r(e, errbuf, sizeof(errbuf)))
errbuf[0] = '\0';
EMSG("pthread_mutex_unlock: %s", errbuf);
EMSG("terminating...");
exit(EXIT_FAILURE);
}
Expand All @@ -334,7 +340,11 @@ CK_RV ckteec_invoke_terminate(void)

e = pthread_mutex_lock(&ta_ctx.init_mutex);
if (e) {
EMSG("pthread_mutex_lock: %s", strerror(e));
char errbuf[STRERROR_BUF_SIZE];

if (strerror_r(e, errbuf, sizeof(errbuf)))
errbuf[0] = '\0';
EMSG("pthread_mutex_lock: %s", errbuf);
EMSG("terminating...");
exit(EXIT_FAILURE);
}
Expand All @@ -351,7 +361,11 @@ CK_RV ckteec_invoke_terminate(void)
out:
e = pthread_mutex_unlock(&ta_ctx.init_mutex);
if (e) {
EMSG("pthread_mutex_unlock: %s", strerror(e));
char errbuf[STRERROR_BUF_SIZE];

if (strerror_r(e, errbuf, sizeof(errbuf)))
errbuf[0] = '\0';
EMSG("pthread_mutex_unlock: %s", errbuf);
EMSG("terminating...");
exit(EXIT_FAILURE);
}
Expand Down
53 changes: 48 additions & 5 deletions libckteec/src/serialize_ck.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,6 +393,9 @@ static CK_RV serialize_mecha_aes_ctr(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
uint32_t size = 0;

if (!param)
return CKR_MECHANISM_PARAM_INVALID;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand Down Expand Up @@ -420,6 +423,9 @@ static CK_RV serialize_mecha_aes_gcm(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
CK_ULONG aad_len = 0;

if (!param)
return CKR_MECHANISM_PARAM_INVALID;

/* AAD is not manadatory */
if (param->pAAD)
aad_len = param->ulAADLen;
Expand Down Expand Up @@ -461,6 +467,9 @@ static CK_RV serialize_mecha_aes_iv(struct serializer *obj,
uint32_t iv_size = mecha->ulParameterLen;
CK_RV rv = CKR_GENERAL_ERROR;

if (iv_size && !mecha->pParameter)
return CKR_MECHANISM_PARAM_INVALID;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand All @@ -479,6 +488,9 @@ static CK_RV serialize_mecha_key_deriv_str(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
uint32_t size = 0;

if (!param)
return CKR_MECHANISM_PARAM_INVALID;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand All @@ -500,8 +512,13 @@ static CK_RV serialize_mecha_ecdh1_derive_param(struct serializer *obj,
{
CK_ECDH1_DERIVE_PARAMS *params = mecha->pParameter;
CK_RV rv = CKR_GENERAL_ERROR;
size_t params_size = 3 * sizeof(uint32_t) + params->ulSharedDataLen +
params->ulPublicDataLen;
size_t params_size = 0;

if (!params)
return CKR_MECHANISM_PARAM_INVALID;

params_size = 3 * sizeof(uint32_t) + params->ulSharedDataLen +
params->ulPublicDataLen;

rv = serialize_32b(obj, obj->type);
if (rv)
Expand Down Expand Up @@ -539,6 +556,12 @@ static CK_RV serialize_mecha_aes_cbc_encrypt_data(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
uint32_t size = 0;

if (!param)
return CKR_MECHANISM_PARAM_INVALID;

if (param->length > UINT32_MAX - sizeof(param->iv) - sizeof(uint32_t))
return CKR_MECHANISM_PARAM_INVALID;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand Down Expand Up @@ -566,6 +589,9 @@ static CK_RV serialize_mecha_rsa_pss_param(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
uint32_t params_size = 3 * sizeof(uint32_t);

if (!params)
return CKR_MECHANISM_PARAM_INVALID;

if (mecha->ulParameterLen != sizeof(*params))
return CKR_ARGUMENTS_BAD;

Expand Down Expand Up @@ -593,11 +619,16 @@ static CK_RV serialize_mecha_rsa_oaep_param(struct serializer *obj,
{
CK_RSA_PKCS_OAEP_PARAMS *params = mecha->pParameter;
CK_RV rv = CKR_GENERAL_ERROR;
size_t params_size = 4 * sizeof(uint32_t) + params->ulSourceDataLen;
size_t params_size = 0;

if (!params)
return CKR_MECHANISM_PARAM_INVALID;

if (mecha->ulParameterLen != sizeof(*params))
return CKR_ARGUMENTS_BAD;

params_size = 4 * sizeof(uint32_t) + params->ulSourceDataLen;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand Down Expand Up @@ -630,13 +661,19 @@ static CK_RV serialize_mecha_rsa_aes_key_wrap(struct serializer *obj,
CK_MECHANISM_PTR mecha)
{
CK_RSA_AES_KEY_WRAP_PARAMS *params = mecha->pParameter;
CK_RSA_PKCS_OAEP_PARAMS *aes_params = params->pOAEPParams;
CK_RSA_PKCS_OAEP_PARAMS *aes_params = NULL;
CK_RV rv = CKR_GENERAL_ERROR;
size_t params_size = 5 * sizeof(uint32_t) + aes_params->ulSourceDataLen;
size_t params_size = 0;

if (!params || !params->pOAEPParams)
return CKR_MECHANISM_PARAM_INVALID;

if (mecha->ulParameterLen != sizeof(*params))
return CKR_ARGUMENTS_BAD;

aes_params = params->pOAEPParams;
params_size = 5 * sizeof(uint32_t) + aes_params->ulSourceDataLen;

rv = serialize_32b(obj, obj->type);
if (rv)
return rv;
Expand Down Expand Up @@ -689,6 +726,9 @@ static CK_RV serialize_mecha_eddsa(struct serializer *obj,
params_len = sizeof(*params);
}

if (!params)
return CKR_MECHANISM_PARAM_INVALID;

if (params_len != sizeof(*params))
return CKR_ARGUMENTS_BAD;

Expand Down Expand Up @@ -717,6 +757,9 @@ static CK_RV serialize_mecha_mac_general_param(struct serializer *obj,
CK_RV rv = CKR_GENERAL_ERROR;
CK_ULONG ck_data = 0;

if (!mecha->pParameter)
return CKR_MECHANISM_PARAM_INVALID;

if (mecha->ulParameterLen != sizeof(ck_data))
return CKR_ARGUMENTS_BAD;

Expand Down
17 changes: 15 additions & 2 deletions libckteec/src/serializer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@

#include <pkcs11_ta.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>

Expand Down Expand Up @@ -44,8 +45,20 @@ void release_serial_object(struct serializer *obj)
*/
static CK_RV serialize(char **bstart, size_t *blen, void *data, size_t len)
{
size_t nlen = *blen + len;
char *buf = realloc(*bstart, nlen);
size_t nlen = 0;
char *buf = NULL;

if (len && !data)
return CKR_ARGUMENTS_BAD;

if (!len)
return CKR_OK;

if (len > SIZE_MAX - *blen)
return CKR_DEVICE_MEMORY;

nlen = *blen + len;
Comment thread
manoj23 marked this conversation as resolved.
buf = realloc(*bstart, nlen);

if (!buf)
return CKR_HOST_MEMORY;
Expand Down
Loading