diff mbox series

[Openvpn-devel,v1] auth-pam: wipe and free partial responses on conversation failure

Message ID 20261112141839.5147-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] auth-pam: wipe and free partial responses on conversation failure |

Commit Message

Gert Doering Nov. 12, 2026, 2:18 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

When a later message failed, my_conv() freed the response array but
not the responses already filled in, leaking copies of the password,
username or OTP without wiping them.

Change-Id: I793327150883ea0207bcb9724341e750bab92474
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>
diff mbox series

Patch

diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c
index 948b6af..d179533 100644
--- a/src/plugins/auth-pam/auth-pam.c
+++ b/src/plugins/auth-pam/auth-pam.c
@@ -779,6 +779,14 @@ 
     }
     else
     {
+        for (int i = 0; i < num_msg; ++i)
+        {
+            if (aresp[i].resp)
+            {
+                plugin_secure_memzero(aresp[i].resp, strlen(aresp[i].resp));
+                free(aresp[i].resp);
+            }
+        }
         free(aresp);
     }