From patchwork Thu Nov 12 14:18:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5677 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:529c:b0:11a:a05e:cb97 with SMTP id x28csp1965113lax; Thu, 12 Nov 2026 06:18:54 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErFbg6GnE4ytFTgUuRzDe+1VfgSkvRGsfpzrN9G56pMo6MUoCyaWoaipOmSaMw+zAb0b/kfhHOtFHC0=@openvpn.net X-Received: by 2002:a05:701b:4513:20b0:143:3c9f:10a6 with SMTP id a92af1059eb24-1b3c023deaemr5185491c88.4.1794493133428; Thu, 12 Nov 2026 06:18:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794493133; cv=none; d=google.com; s=arc-20260327; b=dKIFDal/0k7sUHPV6dh90kGavz6GjV2NhUNwNgDYJJuJ+SNuj7Rz6ddEKlcBQDpFMN YACZutgL4i4e9+cQDgel59CJsTGUKtwcs1EZXD/xMejZidrp5pMKRi3BhtLJc5OS/oHe ghdEr0Hdmz9We/du2lDbKydaLSHm/aD9Lb2fsEr0FM7UGeWvZuiV1y6aUTuFCqiv/yXK AdPdhe8QyZt6Aj0nWjuAPv0RPMwXU29hxryDweWZJz2lS2nCO62O+gnoQyaCkJrIYXTl MzKaHOmEqvR8T26XToE7rHGyuKqfS4Rj7VDVxWO3DQa2+LLW/ICoigV1rJ4Kw4k3+IYf Fpqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=nmoaO5ZZ6g/WXHbTxpHdBHGGohKAVtT3rFy5Id4iw1w=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=NPHyT4Ec18baqHmW7U8UcqjjsyWhft7IOLFE8mgkj5yXdXOjm7DSpWFCS2FWYrfgEA fYk2owEQz7lRtmKB+r0qsm5bosdWTHLrps2zYvJ2Yv7bjF9MQ00jQOh7+YmBh5Mod6Lm HBxoKTbK+6IKInZQLFmApMgiTIcvZQAlt67aElzRib56f2+zYAdcDaF43ILFw0LoM2zZ DE7Cg1NywLbOhNcZtMTAuqAViZVvaExm/fBG2/fss8fjes8KRzo7IcADFd0kdmZjK8V2 2OjVV43FoAKTp8Q1ujxe6fSfGdxjqdntrxgkCoch322c/3OxTERvANqcued2mvoAYPrn HBVg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=gpRi4oxh; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=DtSZ2j+Z; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=iy8TwIHT; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b502aab272si18092c88.52.2026.11.12.06.18.53 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 12 Nov 2026 06:18:53 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=gpRi4oxh; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=DtSZ2j+Z; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=iy8TwIHT; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=nmoaO5ZZ6g/WXHbTxpHdBHGGohKAVtT3rFy5Id4iw1w=; b=gpRi4oxhooPgiv aVwXYp4h9/ePifc+4kcPlM8CqvKGKKLrGl+/ZqzzW3KjGE6ZVhg24U4oh1lOjuoT78Rnvdj9hvdR+ 1HRilYu+iwBE1U8wI7KNI2PMmu9bcp6+ju1/G7NyIZiX07UIaACb2COz6pkkifP/aepMcot3wvFdX xHY=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xRVdb-000000005uu-2Plx; Thu, 12 Nov 2026 14:18:51 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xRVdY-000000005uf-0c9D for openvpn-devel@lists.sourceforge.net; Thu, 12 Nov 2026 14:18:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=+QcpsKqEMDXk8WeQjRo8sAe8ZMOkc5yyQQUmOYnE21c=; b=DtSZ2j+ZMEowwFcBpaoV2tiARF wOn4n1QTa4QTfzaTmu/fJc3vyv3Lu0GZ36boR/+WQpNy8fKftWPnxZkWkMSV6kJcUOS4Byu0Jsufr ctl28mJUYx6A5YPpabLMUnFji9vjumMBjgdkkLGa1YuoWFGOemTovYkNqmoulqcdAQIs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=+QcpsKqEMDXk8WeQjRo8sAe8ZMOkc5yyQQUmOYnE21c=; b=iy8TwIHTBDsNUUcHYiKIiGJoWL wdw+hBB/AZ7pSwWTYxOkcPlJb2v11ROk0iHLICyF6I2ZQXkbdCCmsQQCC6E8JbkookwYmI4Zn11xE 6roQbZlsodWwPPdTpnUpeKNUwOvH63H05985sBEhvUmWlq4uGg4lU4rxhj+B8/wUTwQI=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xRVdW-000000002sy-24CG for openvpn-devel@lists.sourceforge.net; Thu, 12 Nov 2026 14:18:48 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6ACEIdKB005159 for ; Thu, 12 Nov 2026 15:18:39 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6ACEIdGD005158 for openvpn-devel@lists.sourceforge.net; Thu, 12 Nov 2026 15:18:39 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Thu, 12 Nov 2026 15:18:33 +0100 Message-ID: <20261112141839.5147-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru When a later message failed, my_conv() freed the response array but not the responses already filled in, leaking copies of the password, username or OTP without wiping them. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xRVdW-000000002sy-24CG Subject: [Openvpn-devel] [PATCH v1] auth-pam: wipe and free partial responses on conversation failure X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881662432202637812 X-GMAIL-MSGID: 1881662432202637812 From: Razvan Cojocaru When a later message failed, my_conv() freed the response array but not the responses already filled in, leaking copies of the password, username or OTP without wiping them. Change-Id: I793327150883ea0207bcb9724341e750bab92474 Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c index 948b6af..d179533 100644 --- a/src/plugins/auth-pam/auth-pam.c +++ b/src/plugins/auth-pam/auth-pam.c @@ -779,6 +779,14 @@ } else { + for (int i = 0; i < num_msg; ++i) + { + if (aresp[i].resp) + { + plugin_secure_memzero(aresp[i].resp, strlen(aresp[i].resp)); + free(aresp[i].resp); + } + } free(aresp); }