From 1b93588d93e9161b1c085441372828b8e8078055 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 27 Oct 2025 11:12:07 +0100 Subject: [PATCH] psa_crypto_slot_management: check key ID range when loading a persistent key Do not try to load a persistent key whose key ID is in the volatile range. Signed-off-by: Valerio Setti --- library/psa_crypto_slot_management.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/library/psa_crypto_slot_management.c b/library/psa_crypto_slot_management.c index f1a651f0d9..d514d1af04 100644 --- a/library/psa_crypto_slot_management.c +++ b/library/psa_crypto_slot_management.c @@ -684,6 +684,12 @@ static psa_status_t psa_load_persistent_key_into_slot(psa_key_slot_t *slot) psa_status_t status = PSA_SUCCESS; uint8_t *key_data = NULL; size_t key_data_length = 0; + psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID(slot->attr.id); + + /* Do not try to load a persistent key whose ID is in the volatile range. */ + if ((key_id >= PSA_KEY_ID_VOLATILE_MIN) && (key_id <= PSA_KEY_ID_VOLATILE_MAX)) { + return PSA_ERROR_DOES_NOT_EXIST; + } status = psa_load_persistent_key(&slot->attr, &key_data, &key_data_length);