Zephyr 3.7 security related modules update overview

zephyrproject-rtos / zephyr

Primary Git Repository for the Zephyr Project. Zephyr is a new generation, scalable, optimized, secure RTOS for multiple hardware architectures.

https://docs.zephyrproject.org

Apache License 2.0

10.05k stars 6.18k forks source link

Zephyr 3.7 security related modules update overview #73703

Open aescolar opened 1 month ago

aescolar commented 1 month ago

Umbrella issue for tracking security related modules which may require an update before Zephyr 3.7.

[x] https://github.com/zephyrproject-rtos/mbedtls (@ceolin , @d3zd3z , @tomi-font)
- Seems to be on upstream latest 3.6.0 LTS https://github.com/Mbed-TLS/mbedtls
[x] https://github.com/zephyrproject-rtos/tinycrypt (@ceolin )
- Upstream not being developed anymore https://github.com/intel/tinycrypt
[x] https://github.com/zephyrproject-rtos/trusted-firmware-m (@d3zd3z , @ithinuel , @tomi-font )
- Seems to have been update to the latest upstream 2.1.0
- https://tf-m-user-guide.trustedfirmware.org/releases/index.html
[ ] https://github.com/zephyrproject-rtos/trusted-firmware-a (@povergoing, @sgrrzhf, @ithinuel )
- Seems to be 2 upstream releases behind (2.9.0 vs 2.11.0), ~1year
- https://trustedfirmware-a.readthedocs.io/en/latest/change-log.html
[x] https://github.com/zephyrproject-rtos/uoscore-uedhoc (@rlubos , @StefanHri )

aescolar commented 1 month ago

Wrt MbedTLS & tinycrypt, @ceolin can you confirm that we are up to date for the Zephyr 3.7LTS release?
Wrt TF-M @d3zd3z @ithinuel can you confirm that we are up to date?
Wrt TF-A @povergoing would an update of TF-A before the 3.7LTS release be a good idea from a security point of view?

dleach02 commented 1 month ago

Where should we also track any other modules that need to be updated for the? LVGL is one that comes to mind.

aescolar commented 1 month ago

Where should we also track any other modules that need to be updated for the? LVGL is one that comes to mind.

@faxe1008 ^^

What we discussed is that that would be the responsibility of each west project maintainer. Though, @dleach02, you are welcome to make a list and check the status of each module and/or ping each maintainer.

rlubos commented 1 month ago

uoscore-uedhoc upmerge PRs: https://github.com/zephyrproject-rtos/uoscore-uedhoc/pull/4 https://github.com/zephyrproject-rtos/zephyr/pull/73848 Went quite smooth, no surprises.

dkalowsk commented 3 weeks ago

@povergoing @SgrrZhf @ithinuel does it make sense to move Zephyr 3.7 LTS up to TF-A v 2.10 which is the TF-A LTS release. The biggest challenge I see with it (not having tested it) is that 2.10 drops support for the cryptocell712, and I don't know who is or isn't using that in Zephyr.

dleach02 commented 3 weeks ago

that was supposed to be the plan to align all the TFM/TFA/mbedTLS to LTS with the Zephyr LTS.