mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
970b54962f
NVSEncryptedPartition held two XTS_CONTEXT members (mEctxt, mDctxt) for encryption / decryption. Their AES round keys are derived from the NVS encryption key (HMAC-derived or plaintext from nvs_keys partition) and therefore are sensitive secrets. The destructor was empty, so when the NVS encrypted partition object was destroyed -- on nvs_flash_deinit_partition(), on initialization errors, and on any other teardown path -- the XTS round keys were left in DRAM until the freed object's memory happened to be overwritten by a later allocation. A subsequent stack/heap leak primitive would recover the AES key from those bytes. Fix: * Initialize both XTS contexts in the constructor so the destructor's free path is always safe (previously xts_init was only called in init(); destruction before init() would have run xts_free on an uninitialized struct). * Provide a real destructor that calls XTS_FUNC(xts_free) on both contexts, which performs mbedtls_platform_zeroize / esp_aes_xts free semantics on the underlying AES contexts.