github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

Browse Source 
smp_e() already clears the AES key in its "struct aes_enckey aes"
on the stack before leaving the function - but the very same
information is also available as raw key data in the tmp[] array,
so this should get cleared, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Thomas Huth 2026-09-10 14:32:54 +02:00 committed by Luiz Augusto von Dentz
parent 00b201656d
commit c930a69fec
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/smp.c
View File

@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r)
err = aes_prepareenckey(&aes, tmp, 16);
if (err) {
BT_ERR("cipher setkey failed: %d", err);
return err;
goto out_clear;
}
/* Most significant octet of plaintextData corresponds to data[0] */
@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r)
SMP_DBG("r %16phN", r);
out_clear:
memzero_explicit(tmp, sizeof(tmp));
memzero_explicit(&aes, sizeof(aes));
return err;
}