Zeroize key material (#5473, #5474, #6030, #5476)

port/posix/posix_transport_shm.c

@@ -603,6 +603,9 @@ int posixTransportShm_ClientStaticMemDmaCallback(
     else if (oper == WH_DMA_OPER_CLIENT_READ_POST) {
         if (isInDma == 0) {
             uint8_t* ptr = (uint8_t*)dmaPtr + (uintptr_t)*xformedCliAddr;
+            /* The bounce buffer holds a copy of client input (possibly key
+             * material); clear it before returning it to the shared DMA heap. */
+            wh_Utils_ForceZero(ptr, len);
             XFREE(ptr, heap, DYNAMIC_TYPE_TMP_BUFFER);
         }
     }
@@ -611,6 +614,9 @@ int posixTransportShm_ClientStaticMemDmaCallback(
             uint8_t* ptr = (uint8_t*)dmaPtr + (uintptr_t)*xformedCliAddr;
             memcpy((void*)clientAddr, ptr,
                    len); /* copy results of what server wrote */
+            /* The bounce buffer holds server output (possibly key material);
+             * clear it before returning it to the shared DMA heap. */
+            wh_Utils_ForceZero(ptr, len);
             XFREE(ptr, heap, DYNAMIC_TYPE_TMP_BUFFER);
         }
     }

src/wh_client.c

@@ -34,6 +34,7 @@
 /* Common WolfHSM types and defines shared with the server */
 #include "wolfhsm/wh_common.h"
 #include "wolfhsm/wh_error.h"
+#include "wolfhsm/wh_utils.h" /* For wh_Utils_ForceZero */
 
 /* Components */
 #include "wolfhsm/wh_comm.h"
@@ -811,6 +812,7 @@ int wh_Client_KeyCacheRequest_ex(whClientContext* c, uint32_t flags,
     whMessageKeystore_CacheRequest* req = NULL;
     uint8_t*                        packIn;
     uint16_t                        capSz;
+    int                             rc;
 
     if (c == NULL || in == NULL || inSz == 0 ||
         sizeof(*req) + inSz > WOLFHSM_CFG_COMM_DATA_LEN) {
@@ -841,8 +843,16 @@ int wh_Client_KeyCacheRequest_ex(whClientContext* c, uint32_t flags,
     memcpy(packIn, in, inSz);
 
     /* write request */
-    return wh_Client_SendRequest(c, WH_MESSAGE_GROUP_KEY, WH_KEY_CACHE,
-                                 sizeof(*req) + inSz, (uint8_t*)req);
+    rc = wh_Client_SendRequest(c, WH_MESSAGE_GROUP_KEY, WH_KEY_CACHE,
+                               sizeof(*req) + inSz, (uint8_t*)req);
+
+    /* The imported key bytes have been serialized into the transport; do not
+     * leave a copy lingering in the long-lived client comm buffer. The shared
+     * request transport buffer is cleared server-side once the request has been
+     * consumed (see wh_TransportMem_RecvRequest). */
+    wh_Utils_ForceZero(packIn, inSz);
+
+    return rc;
 }
 
 int wh_Client_KeyCacheRequest(whClientContext* c, uint32_t flags,
@@ -1020,6 +1030,10 @@ int wh_Client_KeyExportResponse(whClientContext* c, uint8_t* label,
                     memcpy(label, resp->label, labelSz);
             }
         }
+        /* The response received into the shared comm buffer holds the exported
+         * key material; zeroize the whole received payload before returning on
+         * every path so it does not linger in the long-lived session buffer. */
+        wh_Utils_ForceZero(resp, size);
     }
     return ret;
 }

src/wh_client_keywrap.c

@@ -9,6 +9,7 @@
 #include <wolfhsm/wh_error.h>
 #include <wolfhsm/wh_message.h>
 #include <wolfhsm/wh_message_keystore.h>
+#include <wolfhsm/wh_utils.h> /* For wh_Utils_ForceZero */
 #include <wolfssl/wolfcrypt/settings.h>
 #include <wolfssl/wolfcrypt/types.h>
 
@@ -203,24 +204,30 @@ int wh_Client_KeyUnwrapAndExportResponse(whClientContext*   ctx,
         size < sizeof(*resp) ||
         size < sizeof(*resp) + sizeof(*metadataOut) + resp->keySz ||
         resp->cipherType != cipherType) {
-        return WH_ERROR_ABORTED;
+        ret = WH_ERROR_ABORTED;
     }
-
-    if (resp->rc != WH_ERROR_OK) {
-        return resp->rc;
+    else if (resp->rc != WH_ERROR_OK) {
+        ret = resp->rc;
     }
     else if (resp->keySz > *keyInOutSz) {
-        return WH_ERROR_BUFFER_SIZE;
+        ret = WH_ERROR_BUFFER_SIZE;
+    }
+    else {
+        /* Copy the metadata and key from the response data into metadataOut and
+         * keyOut */
+        respData = (uint8_t*)(resp + 1);
+        memcpy(metadataOut, respData, sizeof(*metadataOut));
+        memcpy(keyOut, respData + sizeof(*metadataOut), resp->keySz);
+        *keyInOutSz = resp->keySz;
+        ret         = WH_ERROR_OK;
     }
 
-    /* Copy the metadata and key from the response data into metadataOut and
-     * keyOut */
-    respData = (uint8_t*)(resp + 1);
-    memcpy(metadataOut, respData, sizeof(*metadataOut));
-    memcpy(keyOut, respData + sizeof(*metadataOut), resp->keySz);
-    *keyInOutSz = resp->keySz;
+    /* The response received into the shared comm buffer holds the recovered
+     * plaintext key; zeroize the whole received payload before returning on
+     * every path so it does not linger in the long-lived session buffer. */
+    wh_Utils_ForceZero(resp, size);
 
-    return WH_ERROR_OK;
+    return ret;
 }
 
 int wh_Client_KeyUnwrapAndExport(whClientContext*   ctx,

src/wh_transport_mem.c

@@ -214,6 +214,17 @@ int wh_TransportMem_SendResponse(void* c, uint16_t len, const void* data)
         wh_Utils_memcpy_flush(context->resp_data, data, len);
     }
 
+    /* The request contents were already copied out at RecvRequest time and the
+     * response is now ready, so the shared request data buffer is no longer
+     * needed. Clear it (with a cache flush, like all shared-buffer writes) so it
+     * does not retain a (possibly sensitive) request payload for another party
+     * mapping the shared region to read. This must happen BEFORE publishing the
+     * response CSR below: that publish releases the client to issue its next
+     * request into req_data, so clearing afterwards could race that write. */
+    if (req.s.len != 0) {
+        (void)wh_Utils_memset_flush(context->req_data, 0, req.s.len);
+    }
+
     resp.s.len = len;
     resp.s.notify = req.s.notify;