From 856d4c6ebc1aec2a714ce497af9c3e48c50e689d Mon Sep 17 00:00:00 2001 From: Neil Horman Date: Wed, 3 Jan 2024 13:47:05 -0500 Subject: [PATCH] cleanse stack variable in kdf_pbkdf1_do_derive kdf_pbkdf1_do_derive stores key derivation information in a stack variable, which is left uncleansed prior to returning. Ensure that the stack information is zeroed prior to return to avoid potential leaks of key information Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/23194) (cherry picked from commit 5963aa8c196d7c5a940a979299a07418527932af) --- providers/implementations/kdfs/pbkdf1.c | 1 + 1 file changed, 1 insertion(+) diff --git a/providers/implementations/kdfs/pbkdf1.c b/providers/implementations/kdfs/pbkdf1.c index 10b27f5a627..9fd76acb502 100644 --- a/providers/implementations/kdfs/pbkdf1.c +++ b/providers/implementations/kdfs/pbkdf1.c @@ -89,6 +89,7 @@ static int kdf_pbkdf1_do_derive(const unsigned char *pass, size_t passlen, memcpy(out, md_tmp, n); ret = 1; err: + OPENSSL_cleanse(md_tmp, EVP_MAX_MD_SIZE); EVP_MD_CTX_free(ctx); return ret; } -- 2.47.2