Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 11 Jan 2013 10:36:56 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: gnome-keyring does not discard stored secrets
 in some cases

On 01/11/2013 08:38 AM, Kurt Seifried wrote:
> On 01/10/2013 11:45 PM, Florian Weimer wrote:
>> I had trouble finding a caller of this function, but the submitter
>> indicated that gnome-power-manager uses it in older versions:
>>
>> <http://git.gnome.org/browse/gnome-power-manager/tree/src/gpm-control.c?h=gnome-2-32#n162>
>>
>>   I'm not sure if this needs a CVE, but it's probably worth fixing
>> anyway.
>
> What security violation occurs/what trust boundary is crossed?

I think the expectation was that key material is discarded on 
suspend/hibernate.  This seems quite desirable for hibernate without 
encrypted swap.

I've verified that Fedora 17 (GNOME 3.4) does not discard cached keys on 
suspend and hibernate, either.  (Swap is encrypted, though, at least I 
selected that in the installer.)  However, I suspect that users expect 
that suspend (but perhaps not hibernate) does not discard keys.

-- 
Florian Weimer / Red Hat Product Security Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.