Commits on Sep 11, 2024

1. bootutil: Fix AES and SHA-256 contexts not zeroized with mbedTLS …

   For some reason, the calls to mbedtls_aes_free, mbedtls_nist_kw_free and
   mbedtls_sha256_free_drop were commented out which means the AES and
   SHA-256 contexts were not properly de-initialized after usage when
   mbedTLS is used. In the case of AES-KW it seems that might lead to a
   memory leak depending on the mbedTLS configuration, but in any case and
   independently of the mbedTLS configuration, this leads to the contexts
   not be zeroized after usage.
   
   Not zeroizing a context means it stays in RAM an undefined amount of
   time, which might enable an attacker to access it and to dump the
   sensitive data it contains.
   
   Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>

   

   taltenbach committed Sep 11, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for f274838
   • Browse repository at this point

   Copy the full SHA

   f274838 View commit details

   Browse the repository at this point in the history