Under porting the cryptsetup-suspend tool for NixOS, an error was found in the LUKS (Linux Unified Key Setup) disk encryption subsystem, which caused the encryption keys to stop being cleared from RAM when the system entered sleep mode starting from the Linux kernel 6.9 (the problematic commit) released in May 2024.
The cryptsetup-suspend tool is used in Debian to automatically lock LUKS partitions before entering sleep mode. It is assumed that in the event of a laptop theft while in sleep mode, the attacker will be denied access to the data, as a password will be required to regain access to the encrypted data upon waking up. Due to a kernel Linux error, after the LUKS partition was locked with the command 'cryptsetup luksSuspend', the keys were not cleared from RAM and remained visible via /proc/keys, allowing an attacker to extract them, for instance, by using a 'cold reboot' method, and access the data.
The absence of key clearing was discovered during debugging a race condition, which caused issues when transitioning to sleep mode. The error occurred after a refactoring in kernel 6.9, where the keys were tied to the calling thread and were supposed to be deleted upon its termination, but in reality, they remained in memory. A one-line patch has been proposed for inclusion in the Linux kernel, which fixes the allowance error.
This patch has not been accepted into the kernel, as a flaw was identified — the patch only applies to physical drives and does not work for virtual loop devices. Instead of fixing the issue on the kernel side, the developers of the cryptsetup tool proposed a workaround for clearing keys. This change has already been accepted and will be included in the cryptsetup 2.8.7 release.
In addition, a custom implementation of scripts for locking encrypted disks before entering sleep mode was created for NixOS, which utilizes an old patch to the kernel that was not accepted in 2015, forcibly clearing keys from memory before entering sleep mode.
Kilde: opennet.ru
