Date: Fri, 11 Jan 2013 10:36:56 +0100 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: gnome-keyring does not discard stored secrets in some cases On 01/11/2013 08:38 AM, Kurt Seifried wrote: > On 01/10/2013 11:45 PM, Florian Weimer wrote: >> I had trouble finding a caller of this function, but the submitter >> indicated that gnome-power-manager uses it in older versions: >> >> <http://git.gnome.org/browse/gnome-power-manager/tree/src/gpm-control.c?h=gnome-2-32#n162> >> >> I'm not sure if this needs a CVE, but it's probably worth fixing >> anyway. > > What security violation occurs/what trust boundary is crossed? I think the expectation was that key material is discarded on suspend/hibernate. This seems quite desirable for hibernate without encrypted swap. I've verified that Fedora 17 (GNOME 3.4) does not discard cached keys on suspend and hibernate, either. (Swap is encrypted, though, at least I selected that in the installer.) However, I suspect that users expect that suspend (but perhaps not hibernate) does not discard keys. -- Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.