wolfHSM Hardening Fixes by aidangarske · Pull Request #425 · wolfSSL/wolfHSM

aidangarske · 2026-06-25T21:18:01Z

F-4235, F-4329, F-4978, F-5139, F-5141, F-5142, F-5473, F-5474, F-5475, F-6029,
F-6030, F-6031, F-6207

aidangarske added 13 commits June 25, 2026 14:15

F-6031 - Zeroize SHE plaintext key in client comm buffer after send

c9aa504

F-5475 - Zeroize prior credential material before storing new value

b31d966

F-5141 - Bound config file path copy to prevent stack overflow

039725a

F-5142 - Bound whnvmtool config path copy to prevent stack overflow

ea858cc

F-5139 - Add O_EXCL to SHM create to close name TOCTOU

28fe33e

F-4235 - Propagate VERIFY_ACERT_DMA error into response before serialize

04027af

F-6029 - Zeroize plaintext key in KeyWrap request comm buffer

d2ec0c0

F-6030 - Zeroize unwrapped plaintext key in export response buffer

c5a6ee5

F-5473 - Zeroize imported key bytes in client cache request buffer

56bc2a2

F-5474 - Zeroize exported key bytes in client response buffer

7044b67

F-6207 - Subtract response header from HKDF and CMAC-KDF output bound

74e8409

F-4329 - Force 64-bit arithmetic in AES-GCM needed_size check

c70003d

F-4978 - Bound AES-GCM response output and tag to comm buffer

efe02ca

aidangarske self-assigned this Jun 25, 2026

aidangarske marked this pull request as ready for review June 25, 2026 22:21

Provide feedback