Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

secure boot v2: Add anti-FI check that secure boot not enabled yet

Browse source 
Prevent a fault from causing bootloader to trust the provided signature incorrectly.
This commit is contained in:
Angus Gratton 2020-04-24 14:42:29 +10:00 committed by Angus Gratton
parent 3c6b1b4c0a
commit b00f38f91c
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
components/bootloader_support/src/esp32/secure_boot_signatures.c
View file

@ -166,6 +166,8 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
return ESP_ERR_INVALID_STATE; return ESP_ERR_INVALID_STATE;
} }
} }
ESP_FAULT_ASSERT(!ets_use_secure_boot_v2());
#endif #endif
memcpy(efuse_trusted_digest, sig_block_trusted_digest, DIGEST_LEN); memcpy(efuse_trusted_digest, sig_block_trusted_digest, DIGEST_LEN);