Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85c4d5c0 authored by Eric Biggers's avatar Eric Biggers
Browse files

Zeroize LockscreenCredential objects received by LockSettingsService

LockscreenCredential objects that were unmarshalled from a Binder
transaction need to be explicitly zeroized.  Otherwise it may be
possible to find them in a ramdump taken afterwards.

There are six methods in ILockSettings that take one or more
LockscreenCredential arguments.  Update all of them to zeroize these
arguments at the end of their execution, provided that they were
actually constructed from a Parcel rather than directly.

Test: atest FrameworksServicesTests:com.android.server.locksettings
Test: Temporarily added log statement for the zeroization, and verified
      that it triggered when unlocking device with LSKF.
Bug: 320392352
Bug: 416768837
Flag: EXEMPT bugfix
Change-Id: I40e06d47b01b1d665122ba9bfd766b9d0df3b485
parent 90e7c178
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment