Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
bootutil: Fix AES and SHA-256 contexts not zeroized with mbedTLS
For some reason, the calls to mbedtls_aes_free, mbedtls_nist_kw_free and mbedtls_sha256_free_drop were commented out which means the AES and SHA-256 contexts were not properly de-initialized after usage when mbedTLS is used. In the case of AES-KW it seems that might lead to a memory leak depending on the mbedTLS configuration, but in any case and independently of the mbedTLS configuration, this leads to the contexts not be zeroized after usage. Not zeroizing a context means it stays in RAM an undefined amount of time, which might enable an attacker to access it and to dump the sensitive data it contains. Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
- Loading branch information