Skip to content

Commit

Permalink
bootutil: fix downgrade prevention
Browse files Browse the repository at this point in the history
Downgrade prevention check moved to secure both TEST
and PERMANENT upgrade modes. Downgrade can still be
performed during REVERT.

Signed-off-by: Michael Grand <m.grand@trustngo.tech>
  • Loading branch information
mimok committed Jun 20, 2023
1 parent 2c1c5d1 commit 2ac3980
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion boot/bootutil/src/loader.c
Original file line number Diff line number Diff line change
Expand Up @@ -2124,13 +2124,14 @@ context_boot_go(struct boot_loader_state *state, struct boot_rsp *rsp)
break;

case BOOT_SWAP_TYPE_TEST:
/* fallthrough */
case BOOT_SWAP_TYPE_PERM:
if (check_downgrade_prevention(state) != 0) {
/* Downgrade prevented */
BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
break;
}
/* fallthrough */
case BOOT_SWAP_TYPE_PERM: /* fallthrough */
case BOOT_SWAP_TYPE_REVERT:
rc = BOOT_HOOK_CALL(boot_perform_update_hook, BOOT_HOOK_REGULAR,
BOOT_CURR_IMG(state), &(BOOT_IMG(state, 1).hdr),
Expand Down

0 comments on commit 2ac3980

Please sign in to comment.