From ab69af541f6e597ec701b855061b95ed5eb78113 Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Fri, 12 Jun 2026 17:45:12 -0500 Subject: [PATCH] fixes for F-1428: Missing ForceZero on sg_buf Containing Decrypted Plaintext in AES-GCM Non-Stream Path F-3293: AES-CCM Non-Contiguous SG Path Missing ForceZero on sg_buf Containing Decrypted Plaintext --- linuxkm/lkcapi_aes_glue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/linuxkm/lkcapi_aes_glue.c b/linuxkm/lkcapi_aes_glue.c index 7764bcc601..4fcd94210a 100644 --- a/linuxkm/lkcapi_aes_glue.c +++ b/linuxkm/lkcapi_aes_glue.c @@ -1515,6 +1515,7 @@ static int AesGcmCrypt_1(struct aead_request *req, int decrypt_p, int rfc4106_p) out: if (sg_buf) { + ForceZero(sg_buf, req->assoclen + req->cryptlen); free(sg_buf); } else { @@ -2009,6 +2010,7 @@ static int AesCcmCrypt_1(struct aead_request *req, int decrypt_p, int rfc4309_p) out: if (sg_buf) { + ForceZero(sg_buf, req->assoclen + req->cryptlen); free(sg_buf); } else {