Cleanse sensitive key material in freed memory#30729
Cleanse sensitive key material in freed memory#30729cyberkittens4u wants to merge 1 commit intoopenssl:masterfrom
Conversation
|
@cyberkittens4u Please fix the CI failure and add This would be OK with CLA: trivial. |
5a8cdba to
fd15f38
Compare
| BN_CTX_end(ctx); | ||
| BN_CTX_free(ctx); | ||
| OPENSSL_free(buf); | ||
| OPENSSL_clear_free(buf, buflen); |
There was a problem hiding this comment.
If you are going to do this here, then buflen needs to be initialized, since there are early exit paths that goto err.
There was a problem hiding this comment.
Sorry, the kittens got overexcited with their very first commit ever and knocked the vase off the table :)
You're right on all three points and we appreciate the thorough review:
-
bn_blind.c — struct only holds pointers and metadata after A/Ai are cleared. Dropped the OPENSSL_clear_free, keeping BN_clear_free on A and Ai only.
-
cms_kari.c — only keklen bytes were written by EVP_DecryptUpdate, bytes beyond that are uninitialized stack. Reverted entirely.
-
ecdh_ossl.c — good catch on the uninitialized buflen on early exit paths. Initialized to 0 at declaration.
Compiled locally this time before pushing. Lesson learned.
- bn_blind.c: BN_free -> BN_clear_free for RSA blinding factors A and Ai - ecdh_ossl.c: OPENSSL_free -> OPENSSL_clear_free on shared secret buffer in error path, initialize buflen to 0 for early exit safety - statem_srvr.c, statem_clnt.c: add OPENSSL_cleanse for sctpauthkey stack buffers after BIO_ctrl (3 instances) These reduce the blast radius of memory disclosure vulnerabilities in applications using OpenSSL, by ensuring key material does not persist in freed heap or stack frames. CLA: trivial Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fd15f38 to
0a1e405
Compare
|
Shane, sorry for the notification delay — all three issues are fixed (compiles locally). These PRs are essentially cleanup to reduce blast radius if a third-party service using OpenSSL were ever compromised. — cyberkittens 🐾 |
4 fixes ensuring sensitive cryptographic material is zeroed before freeing:
BN_free→BN_clear_freefor RSA blinding factors A and Ai,OPENSSL_free→OPENSSL_clear_freefor BN_BLINDING structOPENSSL_free→OPENSSL_clear_freeon shared secret buffer in error pathOPENSSL_cleansefull kek buffer (sizeof(kek)) instead of onlykeklenbytesOPENSSL_cleanseforsctpauthkeystack buffers afterBIO_ctrl(3 instances)These reduce the blast radius of memory disclosure vulnerabilities in applications using OpenSSL, by ensuring key material does not persist in freed heap or stack frames.