From c77d4556732e2e41e975211498406c777136fbaa Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 22 Jul 2022 14:16:33 +0100 Subject: [PATCH] Cleanse the SSLv3 MAC secret when we clean up the read record layer Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18132) --- ssl/record/methods/tls_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c index 0f56db5881c8d..8b541061ba18f 100644 --- a/ssl/record/methods/tls_common.c +++ b/ssl/record/methods/tls_common.c @@ -1198,7 +1198,6 @@ tls_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers, static void tls_int_free(OSSL_RECORD_LAYER *rl) { - /* TODO(RECLAYER): Cleanse sensitive fields */ BIO_free(rl->prev); BIO_free(rl->bio); BIO_free(rl->next); @@ -1210,6 +1209,9 @@ static void tls_int_free(OSSL_RECORD_LAYER *rl) COMP_CTX_free(rl->expand); #endif + if (rl->version == SSL3_VERSION) + OPENSSL_cleanse(rl->mac_secret, sizeof(rl->mac_secret)); + OPENSSL_free(rl); }