From e847afd9ef820060210a8c20c7f35afade483433 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 6 Mar 2025 12:41:39 +0100 Subject: [PATCH] Zeroize temporary heap buffers used in PSA operations Signed-off-by: Gilles Peskine --- ChangeLog.d/psa-zeroize.txt | 2 ++ library/psa_crypto.c | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) create mode 100644 ChangeLog.d/psa-zeroize.txt diff --git a/ChangeLog.d/psa-zeroize.txt b/ChangeLog.d/psa-zeroize.txt new file mode 100644 index 0000000000..e597302dc6 --- /dev/null +++ b/ChangeLog.d/psa-zeroize.txt @@ -0,0 +1,2 @@ +Security + * Zeroize temporary heap buffers used in PSA operations. diff --git a/library/psa_crypto.c b/library/psa_crypto.c index b576f95789..54e497e5d2 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -9300,7 +9300,7 @@ psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len return PSA_SUCCESS; error: - mbedtls_free(local_input->buffer); + mbedtls_zeroize_and_free(local_input->buffer, local_input->length); local_input->buffer = NULL; local_input->length = 0; return status; @@ -9308,7 +9308,7 @@ error: void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input) { - mbedtls_free(local_input->buffer); + mbedtls_zeroize_and_free(local_input->buffer, local_input->length); local_input->buffer = NULL; local_input->length = 0; } @@ -9352,7 +9352,7 @@ psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_outpu return status; } - mbedtls_free(local_output->buffer); + mbedtls_zeroize_and_free(local_output->buffer, local_output->length); local_output->buffer = NULL; local_output->length = 0;