linux-kernel - Re: security: delete BIOS password in keyboard buffer during kernel bootup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b2cc26e40811080839i387e5e94o519a5d1ff0086379@mail.gmail.com>
Date:	Sat, 8 Nov 2008 17:39:17 +0100
From:	"Olaf van der Spek" <olafvdspek@...il.com>
To:	mathias.schnarrenberger@....de
Cc:	linux-kernel@...r.kernel.org
Subject: Re: security: delete BIOS password in keyboard buffer during kernel bootup

On Sat, Nov 8, 2008 at 11:00 AM, Mathias Schnarrenberger
<mathias.schnarrenberger@....de> wrote:
> Hi,
>
> I'm using a BIOS password in my notebook (nc6120 from HP). Recently I noticed that the HP BIOS doesn't clean the keyboard buffer after the password was correctly entered. I know that this is rather a BIOS thing but I assume that other BIOSes also don't clean the BIOS keyboard ring buffer (at adress from 0x0000041E up to 0x0000043D). Since after the kernel boot up the BIOS Keyboard ISR is deactivated no one cares about the data in the keyboard buffer. So, the BIOS password is kept in the buffer.
>
> So, I think it would be good if the kernel clears the keyboard buffer during boot up (at least in x86-based systems) to protect the users password. I don't know anything about EFI-based systems and other architectures.
> Because I'm not sure where to implement the code to delete the keyboard buffer in the kernel, I can't make a proper patch. Possibly one of you can do this ;)

What if my BIOS stores some critical info at that memory address?
I don't think the kernel is the right place to work around this issue.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/