wolfHSM Hardening Fixes by aidangarske · Pull Request #425 · wolfSSL/wolfHSM

aidangarske · 2026-06-25T21:18:01Z

F-4235, F-4329, F-4978, F-5139, F-5141, F-5142, F-5473, F-5474, F-5475, F-6029,
F-6030, F-6031, F-6207

aidangarske self-assigned this Jun 25, 2026

aidangarske marked this pull request as ready for review June 25, 2026 22:21

aidangarske added 13 commits June 29, 2026 09:43

F-6031 - Zeroize SHE plaintext key in client comm buffer after send

2499950

F-5475 - Zeroize prior credential material before storing new value

b8a14fc

F-5141 - Bound config file path copy to prevent stack overflow

52b384a

F-5142 - Bound whnvmtool config path copy to prevent stack overflow

fa3b67c

F-5139 - Add O_EXCL to SHM create to close name TOCTOU

9943c73

F-4235 - Propagate VERIFY_ACERT_DMA error into response before serialize

61d3843

F-6029 - Zeroize plaintext key in KeyWrap request comm buffer

75993c1

F-6030 - Zeroize unwrapped plaintext key in export response buffer

09754e7

F-5473 - Zeroize imported key bytes in client cache request buffer

9b68365

F-5474 - Zeroize exported key bytes in client response buffer

cfb6c06

F-6207 - Subtract response header from HKDF and CMAC-KDF output bound

bfdd9fc

F-4329 - Force 64-bit arithmetic in AES-GCM needed_size check

fbf89e1

F-4978 - Bound AES-GCM response output and tag to comm buffer

d35e929

aidangarske force-pushed the fenrir-high-zeroize-bounds branch from efe02ca to d35e929 Compare June 29, 2026 16:45

aidangarske requested a review from bigbrett June 29, 2026 16:47

Provide feedback