From 57ad215615071a7dc578e390de61ae163b15df9d Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Mon, 31 Jul 2017 20:38:26 +0200 Subject: [PATCH] Fix an information leak in the RSA padding check code. The memory blocks contain secret data and must be cleared before returning to the system heap. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/4063) --- crypto/rsa/rsa_oaep.c | 8 ++++++-- crypto/rsa/rsa_pk1.c | 4 +++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/crypto/rsa/rsa_oaep.c b/crypto/rsa/rsa_oaep.c index 19d28c6f0e..9a01b4afc1 100644 --- a/crypto/rsa/rsa_oaep.c +++ b/crypto/rsa/rsa_oaep.c @@ -237,10 +237,14 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen, RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, RSA_R_OAEP_DECODING_ERROR); cleanup: - if (db != NULL) + if (db != NULL) { + OPENSSL_cleanse(db, dblen); OPENSSL_free(db); - if (em != NULL) + } + if (em != NULL) { + OPENSSL_cleanse(em, num); OPENSSL_free(em); + } return mlen; } diff --git a/crypto/rsa/rsa_pk1.c b/crypto/rsa/rsa_pk1.c index 017766ce71..50397c335a 100644 --- a/crypto/rsa/rsa_pk1.c +++ b/crypto/rsa/rsa_pk1.c @@ -264,8 +264,10 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, memcpy(to, em + msg_index, mlen); err: - if (em != NULL) + if (em != NULL) { + OPENSSL_cleanse(em, num); OPENSSL_free(em); + } if (mlen == -1) RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR); -- 2.25.1