* [PATCH] crypto/krb5: use kfree_sensitive() for derived key buffers
@ 2026-08-03 19:26 Jan Sebastian Götte
0 siblings, 0 replies; only message in thread
From: Jan Sebastian Götte @ 2026-08-03 19:26 UTC (permalink / raw)
To: Herbert Xu, David S. Miller, David Howells
Cc: Jakub Kicinski, Michael Bommarito, Jeffrey Altman, linux-crypto,
linux-kernel, linux-hardening, Jan Sebastian Götte, stable
crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum()
free the buffer holding the freshly derived keys with plain kfree(),
leaving the key material behind in the freed slab object.
Fixes: 3936f02bf2d3 ("crypto/krb5: Implement Kerberos crypto core")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Sebastian Götte <linux@jaseg.de>
---
crypto/krb5/krb5_api.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crypto/krb5/krb5_api.c b/crypto/krb5/krb5_api.c
index 03395b89cc61..b377f4f7558d 100644
--- a/crypto/krb5/krb5_api.c
+++ b/crypto/krb5/krb5_api.c
@@ -263,10 +263,10 @@ struct crypto_aead *crypto_krb5_prepare_encryption(const struct krb5_enctype *kr
goto err;
}
- kfree(keys.data);
+ kfree_sensitive(keys.data);
return ci;
err:
- kfree(keys.data);
+ kfree_sensitive(keys.data);
return ERR_PTR(ret);
}
EXPORT_SYMBOL(crypto_krb5_prepare_encryption);
@@ -333,10 +333,10 @@ struct crypto_shash *crypto_krb5_prepare_checksum(const struct krb5_enctype *krb
goto err;
}
- kfree(keys.data);
+ kfree_sensitive(keys.data);
return ci;
err:
- kfree(keys.data);
+ kfree_sensitive(keys.data);
return ERR_PTR(ret);
}
EXPORT_SYMBOL(crypto_krb5_prepare_checksum);
--
2.53.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-03 19:26 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-03 19:26 [PATCH] crypto/krb5: use kfree_sensitive() for derived key buffers Jan Sebastian Götte
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.