linux-kernel - security: delete BIOS password in keyboard buffer during kernel bootup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200811081100.03966.mathias.schnarrenberger@gmx.de>
Date:	Sat, 8 Nov 2008 11:00:03 +0100
From:	Mathias Schnarrenberger <mathias.schnarrenberger@....de>
To:	linux-kernel@...r.kernel.org
Subject: security: delete BIOS password in keyboard buffer during kernel bootup

Hi,

I'm using a BIOS password in my notebook (nc6120 from HP). Recently I noticed that the HP BIOS doesn't clean the keyboard buffer after the password was correctly entered. I know that this is rather a BIOS thing but I assume that other BIOSes also don't clean the BIOS keyboard ring buffer (at adress from 0x0000041E up to 0x0000043D). Since after the kernel boot up the BIOS Keyboard ISR is deactivated no one cares about the data in the keyboard buffer. So, the BIOS password is kept in the buffer.

So, I think it would be good if the kernel clears the keyboard buffer during boot up (at least in x86-based systems) to protect the users password. I don't know anything about EFI-based systems and other architectures.
Because I'm not sure where to implement the code to delete the keyboard buffer in the kernel, I can't make a proper patch. Possibly one of you can do this ;)

To read the BIOS keyboard buffer this piece of code can be used:

#include <stdio.h>
#include <string.h>
int main(void) {
  FILE *file;
  int i;
  char keybuffer[32];

  file = fopen("/dev/mem","r");

  if (file==NULL) {
    printf("Couldn't open file\n");
    return 0;
  }
  //set pointer to keyboard buffer
  fseek(file, 0x41E, SEEK_SET);
  //get ASCII / scancodes
  for (i=0;i<32;i++)
    keybuffer[i] = fgetc(file);

  fclose(file);

  for (i=0;i<32;i++)
    printf("position in buffer: %i \t value %i \t character %c\n",i,(int)keybuffer[i],keybuffer[i]);

  return 0;
}

I hope I didn't waste too much of your time.

Best regards,
Mathias Schnarrenberger
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/