tkip_detach() frees tkip_ctx without zeroing derived key material (tx/rx_rc4key, tx/rx_ttak) while the framework memsets the master key — freed-heap key residue
Summary
When a TKIP key is deleted, _ieee80211_crypto_delkey() deliberately memsets the master key after cipher_detach - but tkip_detach() kfrees the tkip_ctx with no zeroing, leaving up to 64 bytes of key-derived material on the freed heap: tx/rc4key[16] are fully-mixed per-packet RC4 keys and ttak[5] is the phase-1 mixing state. A subsequent kernel heap-info-leak primitive that reuses the chunk discloses RC4 keys usable to decrypt captured TKIP frames for the corresponding TSC range - defeating the framework's own zeroization intent. Hardening gap (needs a separate leak to matter). Fix: memset(ctx,0,sizeof) before free (ccmp/wep deserve the same audit). Also noted: DF-0594/0595 still unfixed. [VERIFIED pass2: tkip_ctx freed without zeroing rc4keys ttak while framework memsets master key; memset-before-free compiled]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3413 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 236 B | ↓ raw | |
| fix.diff | — | 488 B | view raw | |
| manifest.json | — | 347 B | view raw | |
| verdict.json | — | 1.5 KB | view raw |
DF-3413 evidence pack
What
tkip_detach frees tkip_ctx without zeroing derived key material
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablefix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - residue gap, needs a leak to matter
Verified recommended fix
memset(ctx, 0, sizeof(*ctx)) before IEEE80211_FREE
Verdict
Line-accurate confirmation; no meaningful runtime demonstration (the gap requires a separate heap-info-leak primitive to matter). _ieee80211_crypto_delkey memsets the MASTER key after cipher_detach, but tkip_detach kfrees the tkip_ctx (up to 64 bytes of tx/rx_rc4key[16] fully-mixed per-packet RC4 keys and tx/rx_ttak[5] phase-1 mixing state) with no zeroing (ieee80211_crypto_tkip.c:131-139) - defeating the frameworks own zeroization intent on the freed heap chunk. Fix memsets the ctx before free; compiled in the F40FIX build (wlan_tkip in kernel).
No comments yet.