[SECURITY PATCH 7/8] disk/cryptodisk: Wipe the passphrase from memory - Daniel Kiper via Grub-devel

From: Daniel Kiper via Grub-devel <grub-devel@gnu.org>
To: grub-devel@gnu.org
Cc: Daniel Kiper <daniel.kiper@oracle.com>,
	dfirblog@gmail.com, eworm@archlinux.org, glin@suse.com,
	mbenatto@redhat.com, mchang@suse.com, meissner@suse.com,
	tpowa@archlinux.org
Subject: [SECURITY PATCH 7/8] disk/cryptodisk: Wipe the passphrase from memory
Date: Thu,  8 May 2025 19:02:13 +0200	[thread overview]
Message-ID: <20250508170214.26577-8-daniel.kiper@oracle.com> (raw)
In-Reply-To: <20250508170214.26577-1-daniel.kiper@oracle.com>

From: Maxim Suhanov <dfirblog@gmail.com>

Switching to another EFI boot application while there are secrets in
RAM is dangerous, because not all firmware is wiping memory on free.

To reduce the attack surface, wipe the passphrase acquired when
unlocking an encrypted volume.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/disk/cryptodisk.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 544a30d61..7065bcdcb 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -1302,6 +1302,7 @@ grub_cryptodisk_scan_device_real (const char *name,
 
   if (askpass)
     {
+      grub_memset (cargs->key_data, 0, cargs->key_len);
       cargs->key_len = 0;
       grub_free (cargs->key_data);
     }
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
