env: Migrate CONFIG_ENV_AES to Kconfig and deprecate
PATCH 1/1 env: Migrate CONFIG_ENV_AES to Kconfig and deprecate
The underlying implementation for ENV_AES has security complications and is not recommended for use. Please see CVE-2017-3225 and CVE-2017-3226 for more details. Mark this as deprecated now and delete this in the medium term if no one comes forward to re-work the support.
Signed-off-by Tom Rini <[email protected]>
--- env/Kconfig | 8 ++++++++ scripts/config_whitelist.txt | 1 - 2 files changed, 8 insertions(+), 1 deletion(-)
env/Kconfig +8 -0
@@ -375,6 +375,14 @@ config ENV_IS_IN_UBI endchoice +config ENV_AES + bool "AES-128 encryption for stored environment (DEPRECATED)" + help + Enable this to have the on-device stored environment be encrypted + with AES-128. The implementation here however has security + complications and is not recommended for use. Please see + CVE-2017-3225 and CVE-2017-3226 for more details. + config ENV_FAT_INTERFACE string "Name of the block device for the environment" depends on ENV_IS_IN_FAT
scripts/config_whitelist.txt +0 -1
@@ -574,7 +574,6 @@ CONFIG_ENV_ACCESS_IGNORE_FORCE CONFIG_ENV_ADDR CONFIG_ENV_ADDR_FLEX CONFIG_ENV_ADDR_REDUND -CONFIG_ENV_AES CONFIG_ENV_BASE CONFIG_ENV_CALLBACK_LIST_DEFAULT CONFIG_ENV_CALLBACK_LIST_STATIC
Signature · 1 line
1.9.1
PATCH 1/1 env: Migrate CONFIG_ENV_AES to Kconfig and deprecate
Quoted 6 lines · Tom Rini
The underlying implementation for
ENV_AEShas security complications and is not recommended for use. Please see CVE-2017-3225 and CVE-2017-3226 for more details. Mark this as deprecated now and delete this in the medium term if no one comes forward to re-work the support.Signed-off-by Tom Rini <[email protected]>
Applied to u-boot/master, thanks!
Signature · 8 lines
Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170908/aee53a35/attachment.sig>