Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9bddd59 authored by Eric Biggers's avatar Eric Biggers
Browse files

Zeroize weaverSecret in unlockLskfBasedProtector() 

Secrets derived from or unlocked by the LSKF need to be zeroized as soon
as they are no longer needed.

Test: atest FrameworksServicesTests:com.android.server.locksettings
Bug: 320392352
Bug: 395976735
Flag: EXEMPT bugfix
Change-Id: I391533ae3eb5d56f687bb18d64aceb7b309cde67
parent 23284076

services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java

+4 −1
Original line number Diff line number Diff line
@@ -1428,6 +1428,7 @@ class SyntheticPasswordManager { 


        byte[] stretchedLskf = null;

        byte[] weaverKey = null;

        byte[] weaverSecret = null;

        byte[] gkPassword = null;

        byte[] protectorSecret = null;

        try {
@@ -1445,11 +1446,12 @@ class SyntheticPasswordManager { 
                }

                weaverKey = stretchedLskfToWeaverKey(stretchedLskf);

                WeaverReadResponse weaverResponse = weaverVerify(weaver, weaverSlot, weaverKey);

                weaverSecret = weaverResponse.value;

                if (weaverResponse.status != WeaverReadStatus.OK) {

                    result.response = verifyCredentialResponseFromWeaverResponse(weaverResponse);

                    return result;

                }

                protectorSecret = transformUnderWeaverSecret(stretchedLskf, weaverResponse.value);

                protectorSecret = transformUnderWeaverSecret(stretchedLskf, weaverSecret);

            } else {

                // Weaver is unavailable, so the protector uses Gatekeeper to verify the LSKF,

                // unless the LSKF is empty in which case Gatekeeper might not have been used at
@@ -1542,6 +1544,7 @@ class SyntheticPasswordManager { 
        } finally {

            ArrayUtils.zeroize(stretchedLskf);

            ArrayUtils.zeroize(weaverKey);

            ArrayUtils.zeroize(weaverSecret);

            ArrayUtils.zeroize(gkPassword);

            ArrayUtils.zeroize(protectorSecret);

        }