From de9c30b2071e4aff8819d29c03d98767c8a3ec5b Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Fri, 10 Jul 2026 17:09:58 +0200 Subject: irmd: Harden OAP client KEM completion do_client_kex_complete_kem() filled key_buf in the server-encap branch and returned early in the client-encap branch; any other mode value would fall through and memcpy an uninitialized stack buffer into the session key. The client only ever sets the two known modes today, but nothing local enforces that and the server derives its mode from a wire bit. Give each mode an explicit path with no fall-through. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/cli.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c index 3518b4d1..d54eb26b 100644 --- a/src/irmd/oap/cli.c +++ b/src/irmd/oap/cli.c @@ -385,26 +385,9 @@ static int do_client_kex_complete_kem(struct oap_cli_ctx * s, struct sec_config * scfg = &s->scfg; uint8_t * id = s->id.data; uint8_t key_buf[SYMMKEYSZ]; + buffer_t ct; - if (scfg->x.mode == KEM_MODE_SERVER_ENCAP) { - buffer_t ct; - - if (peer_hdr->kex.len == 0) { - log_err_id(id, "Server did not send KEM CT."); - return -ECRYPT; - } - - ct.data = peer_hdr->kex.data; - ct.len = peer_hdr->kex.len; - - if (kex_kem_decap(s->pkp, ct, scfg->k.nid, key_buf) < 0) { - log_err_id(id, "Failed to decapsulate KEM."); - return -ECRYPT; - } - - log_dbg_id(id, "Client decapsulated server CT."); - - } else if (scfg->x.mode == KEM_MODE_CLIENT_ENCAP) { + if (scfg->x.mode == KEM_MODE_CLIENT_ENCAP) { /* Key already derived during prepare */ memcpy(sk->key, s->key, SYMMKEYSZ); sk->nid = scfg->c.nid; @@ -413,6 +396,22 @@ static int do_client_kex_complete_kem(struct oap_cli_ctx * s, return 0; } + /* KEM_MODE_SERVER_ENCAP */ + if (peer_hdr->kex.len == 0) { + log_err_id(id, "Server did not send KEM CT."); + return -ECRYPT; + } + + ct.data = peer_hdr->kex.data; + ct.len = peer_hdr->kex.len; + + if (kex_kem_decap(s->pkp, ct, scfg->k.nid, key_buf) < 0) { + log_err_id(id, "Failed to decapsulate KEM."); + return -ECRYPT; + } + + log_dbg_id(id, "Client decapsulated server CT."); + memcpy(sk->key, key_buf, SYMMKEYSZ); sk->nid = scfg->c.nid; crypt_secure_clear(key_buf, SYMMKEYSZ); -- cgit v1.2.3