The Espressif AES driver drivers/crypto/cryptoesp32aes.c advertises a multi-session cipher API — it hands out up to…

The Espressif AES driver drivers/crypto/cryptoesp32aes.c advertises a multi-session cipher API — it hands out up to CONFIGESP32CRYPTOAESSESSIONSMAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode registers, and aesbeginsession() programmed them exactly once, at session start, outside the aeslock mutex that serialises the transforms. The per-operation handlers aesecbop(), aescbcop() and aesctrop() then ran aeshaltransformblock() against whatever key and direction the registers happened to hold. As a result, once a second session is opened with a different key, every subsequent operation on the first session silently uses the second session's key and direction, and no error is reported. Because the key programming happened outside the lock, the correct usage pattern of "each thread does begin, then op, then free on its own session" also races: a second thread's cipherbeginsession() landing between the first thread's begin and its operation makes that operation run under the second thread's key. An attacker who can induce session creation on the device — for example a protocol peer…

curl https://cve.zerocrew.in/api/cve/CVE-2026-82390