For security concern, clean password buffer after using it.
Cc: Feng Tian <[email protected]>
Cc: Jiewen Yao <[email protected]>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <[email protected]>
---
SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c | 5 +++++
SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c | 27 +++++++++++++++++++----
2 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
index 7c6deb8..1c31291 100644
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
@@ -241,6 +241,11 @@ OpalDriverPopUpHddPassword (
UnicodeStrToAsciiStr(Unicode, Ascii);
+ //
+ // For security concern, must clean the passord memory.
+ //
+ ZeroMem (Unicode, sizeof (Unicode));
+
return Ascii;
}
diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
index 3fb3553..bae2b2b 100644
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
@@ -624,6 +624,8 @@ HiiPsidRevert(
Ret = OpalSupportPsidRevert(&Session, Psid.Psid,
(UINT32)sizeof(Psid.Psid), OpalDisk->OpalDevicePath);
}
+ ZeroMem (&Psid, sizeof (PsidStringId));
+
if (Ret == TcgResultSuccess) {
AsciiSPrint( Response, DEFAULT_RESPONSE_SIZE, "%a", "PSID Revert: Success"
);
} else {
@@ -1029,8 +1031,8 @@ HiiPasswordEntered(
EFI_STRING_ID Str
)
{
- OPAL_DISK* OpalDisk;
- CHAR8 Password[MAX_PASSWORD_CHARACTER_LENGTH + 1];
+ OPAL_DISK* OpalDisk;
+ CHAR8 Password[MAX_PASSWORD_CHARACTER_LENGTH + 1];
CHAR16* UniStr;
UINT32 PassLength;
EFI_STATUS Status;
@@ -1054,15 +1056,30 @@ HiiPasswordEntered(
if (UniStr == NULL) {
return EFI_NOT_FOUND;
}
+
+ //
+ // For security concern, must clean the password saved in string package.
+ //
+ HiiSetString(gHiiPackageListHandle, Str, L"", NULL);
+
PassLength = (UINT32) StrLen (UniStr);
if (PassLength >= sizeof(Password)) {
HiiSetFormString(STRING_TOKEN(STR_ACTION_STATUS), "Password too long");
- gBS->FreePool(UniStr);
+ //
+ // For security concern, must clean the password saved in string package.
+ //
+ ZeroMem (UniStr, StrSize (UniStr));
+ FreePool(UniStr);
return EFI_BUFFER_TOO_SMALL;
}
UnicodeStrToAsciiStr(UniStr, Password);
- gBS->FreePool(UniStr);
+
+ //
+ // For security concern, must clean the password saved in string package.
+ //
+ ZeroMem (UniStr, StrSize (UniStr));
+ FreePool(UniStr);
if (gHiiConfiguration.SelectedAction == HII_KEY_ID_GOTO_UNLOCK) {
Status = HiiUnlock (OpalDisk, Password, PassLength);
@@ -1077,6 +1094,8 @@ HiiPasswordEntered(
Status = HiiSetPassword(OpalDisk, Password, PassLength);
}
+ ZeroMem (Password, sizeof (Password));
+
OpalHiiSetBrowserData ();
return Status;
--
2.6.4.windows.1
_______________________________________________
edk2-devel mailing list
[email protected]
https://lists.01.org/mailman/listinfo/edk2-devel
