tree 0110ccda8aa5dd5c5537970b5c0d434575a12668
parent ca06b9fe6d3c20a824a3f7e1196e89ab6134d08b
author Thomas Altenbach <thomas.altenbach@legrand.com> 1726069815 +0200
committer Jamie <40387179+nordicjm@users.noreply.github.com> 1726146572 +0100

bootutil: Fix AES and SHA-256 contexts not zeroized with mbedTLS

For some reason, the calls to mbedtls_aes_free, mbedtls_nist_kw_free and
mbedtls_sha256_free_drop were commented out which means the AES and
SHA-256 contexts were not properly de-initialized after usage when
mbedTLS is used. In the case of AES-KW it seems that might lead to a
memory leak depending on the mbedTLS configuration, but in any case and
independently of the mbedTLS configuration, this leads to the contexts
not be zeroized after usage.

Not zeroizing a context means it stays in RAM an undefined amount of
time, which might enable an attacker to access it and to dump the
sensitive data it contains.

Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>