diff mbox series

[Openvpn-devel,v1] ssl_mbedtls: wipe private key password buffer after use

Message ID 20261114154843.1738-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] ssl_mbedtls: wipe private key password buffer after use |

Commit Message

Gert Doering Nov. 14, 2026, 3:48 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

tls_ctx_load_priv_file() left the private key password on the stack.
Clear passbuf with secure_memzero() once the key has been parsed.

Change-Id: I5099b109d43664d5b83adfded6adfaf5ae9d608f
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2099
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2099
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>
diff mbox series

Patch

diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index 8aaca96..9561abb 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -481,6 +481,7 @@ 
             status = mbedtls_pk_parse_key(
                 ctx->priv_key, (const unsigned char *)priv_key_file, strlen(priv_key_file) + 1,
                 (unsigned char *)passbuf, strlen(passbuf));
+            secure_memzero(passbuf, sizeof(passbuf));
         }
     }
     else
@@ -491,6 +492,7 @@ 
             char passbuf[512] = { 0 };
             pem_password_callback(passbuf, 512, 0, NULL);
             status = mbedtls_pk_parse_keyfile(ctx->priv_key, priv_key_file, passbuf);
+            secure_memzero(passbuf, sizeof(passbuf));
         }
     }
     if (!mbed_ok(status))