linux-kernel - crypto: zeroization of sensitive data in af

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 09 Nov 2014 23:33:52 +0100
From:	Stephan Mueller <smueller@...onox.de>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org
Subject: crypto: zeroization of sensitive data in af_alg

Hi Herbert,

while working on the AF_ALG interface, I saw no active zeroizations of memory 
that may hold sensitive data that is maintained outside the kernel crypto API 
cipher handles. I think the following memory segments fall under that 
category:

	* message digest

	* IV

	* plaintext / ciphertext handed in by consumer

	* ciphertext / plaintext that is send back to the consumer

May I ask whether such zeroizations are present? At least I did not find it. 
If we conclude that there is a need for adding such zeroizations, I checked 
the code for the appropriate locations:

I think I found the location for the first one: hash_sock_destruct that should 
be enhanced with a memset(0) of ctx->result. I have a patch ready which is 
tested and works.

For the IV, I think I found the spot as well: skcipher_sock_destruct. This 
function should be enhanced with a memset(0) of ctx->iv. Again, I have a patch 
ready which is tested and works.

However, I am failing to find the right spot to add a zeroization for the 
latter one, i.e. the code that handles the pages send in by the user or the 
pages that are returned by the crypto API. Initially I thought 
skcipher_pull_sgl is a good spot for the symmetric ciphers as it evicts the 
used pages out of the scope of the kernel crypto API. I added a 
clear_page(sg_page(sg+1)) as well as memset(sg_page(sg+1), 0, plen) right 
before the put_page call. All that I got in return was a BUG() from the memory 
management layer.

Then I tried the same in af_alg_free_sg() as this function is used by 
algif_hash.c -- with the same result.

That makes me wonder: where should such a zeroization call be added?

Thanks

-- 
Ciao
Stephan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/