From cd5be32191eeeb6149d51930b4245710875b3773 Mon Sep 17 00:00:00 2001 From: Steven Cooreman Date: Fri, 25 Feb 2022 11:14:59 +0100 Subject: [PATCH 1/2] Erase secrets in allocated memory before freeing said memory Signed-off-by: Steven Cooreman --- library/psa_crypto_storage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/library/psa_crypto_storage.c b/library/psa_crypto_storage.c index c6660b955..db7786d6c 100644 --- a/library/psa_crypto_storage.c +++ b/library/psa_crypto_storage.c @@ -349,6 +349,7 @@ psa_status_t psa_save_persistent_key( const psa_core_key_attributes_t *attr, status = psa_crypto_storage_store( attr->id, storage_data, storage_data_length ); + mbedtls_platform_zeroize( storage_data, storage_data_length ); mbedtls_free( storage_data ); return( status ); @@ -394,6 +395,7 @@ psa_status_t psa_load_persistent_key( psa_core_key_attributes_t *attr, status = PSA_ERROR_STORAGE_FAILURE; exit: + mbedtls_platform_zeroize( loaded_data, storage_data_length ); mbedtls_free( loaded_data ); return( status ); } From 4b94f10b9357d5b31b1a5a6426def5d8ed18f4b9 Mon Sep 17 00:00:00 2001 From: Steven Cooreman Date: Fri, 25 Feb 2022 16:53:11 +0100 Subject: [PATCH 2/2] Add changelog entry for zeroizing key buffers before freeing Signed-off-by: Steven Cooreman --- ChangeLog.d/zeroize_key_buffers_before_free.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/zeroize_key_buffers_before_free.txt diff --git a/ChangeLog.d/zeroize_key_buffers_before_free.txt b/ChangeLog.d/zeroize_key_buffers_before_free.txt new file mode 100644 index 000000000..ba5bae191 --- /dev/null +++ b/ChangeLog.d/zeroize_key_buffers_before_free.txt @@ -0,0 +1,4 @@ +Security + * Zeroize dynamically-allocated buffers used by the PSA Crypto key storage + module before freeing them. These buffers contain secret key material, and + could thus potentially leak the key through freed heap.