From dbc0eb5bd1f40de9b394e3a86e84f46c39a23e40 Mon Sep 17 00:00:00 2001 From: Maxim Suhanov Date: Tue, 4 Mar 2025 15:27:59 +0300 Subject: [PATCH] disk/cryptodisk: Wipe the passphrase from memory Switching to another EFI boot application while there are secrets in RAM is dangerous, because not all firmware is wiping memory on free. To reduce the attack surface, wipe the passphrase acquired when unlocking an encrypted volume. Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- grub-core/disk/cryptodisk.c | 1 + 1 file changed, 1 insertion(+) diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c index 544a30d61..7065bcdcb 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c @@ -1302,6 +1302,7 @@ grub_cryptodisk_scan_device_real (const char *name, if (askpass) { + grub_memset (cargs->key_data, 0, cargs->key_len); cargs->key_len = 0; grub_free (cargs->key_data); } -- 2.47.2