espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-31 03:07:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

system/security: Memprot bypassing mitigation

Browse Source 
Check Memprot lock bit(s) during the system startup, abort/reset on any Memprot parts found locked during this phase.
There is no legal reason to disallow the Memprot configuration by the system, so it's either a critical bug in the
application or an malicious attempt to bypass the system security.
Error message is printed before digital system reset.

Closes IDF-2700
This commit is contained in:
Martin Vychodil
2021-06-01 00:07:09 +02:00
parent 0423027d5d
commit b04705cfe2
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
components/esp_system/port/cpu_start.c
View File

@ -467,6 +467,12 @@ void IRAM_ATTR call_start_cpu0(void)
esp_cache_err_int_init(); esp_cache_err_int_init();
#if CONFIG_ESP_SYSTEM_MEMPROT_FEATURE #if CONFIG_ESP_SYSTEM_MEMPROT_FEATURE
// Memprot cannot be locked during OS startup as the lock-on prevents any PMS changes until a next reboot
// If such a situation appears, it is likely an malicious attempt to bypass the system safety setup -> print error & reset
if ( esp_memprot_is_locked_any() ) {
ESP_EARLY_LOGE(TAG, "Memprot feature locked after the system reset! Potential safety corruption, rebooting.");
esp_restart_noos_dig();
}
#if CONFIG_ESP_SYSTEM_MEMPROT_FEATURE_LOCK #if CONFIG_ESP_SYSTEM_MEMPROT_FEATURE_LOCK
esp_memprot_set_prot(true, true, NULL); esp_memprot_set_prot(true, true, NULL);
#else #else