During the porting of the cryptsetup-suspend toolkit to NixOS, a bug was discovered in the LUKS disk encryption subsystem (Linux Unified Key Setup), due to which, starting from the kernel Linux 6.9 (the problematic commit), released in May 2024, stopped clearing encryption keys from RAM when the system went into standby mode.
The cryptsetup-suspend tool is used in Debian to automatically lock LUKS partitions before entering sleep mode. It is assumed that if a laptop is stolen while in sleep mode, an attacker will be unable to access the data, as waking from sleep mode will require entering a password to restore access to the encrypted data. Due to a kernel bug Linux After locking the LUKS partition with the "cryptsetup luksSuspend" command, the keys were not cleared from RAM and remained visible through /proc/keys, which allowed an attacker to extract them, for example, using the "cold boot" method, and use them to access data.
The missing key cleanup was discovered while debugging a race condition that was causing sleep issues. The bug arose after a refactoring in the 6.9 kernel, which caused keys to be tied to the calling thread and should have been deleted upon its termination, but instead remained in memory. For inclusion in the kernel, Linux A one-line patch has been proposed to fix the error.
This patch has not been accepted into the kernel because it contains a flaw: it only works for physical drives, not virtual loop devices. Instead of fixing the kernel issue, the cryptsetup tool developers proposed a workaround for clearing keys. This change has already been accepted and will be included in the cryptsetup 2.8.7 release.
Additionally, NixOS has a custom implementation of scripts for locking encrypted disks before switching to sleep mode, which uses an old kernel patch, not adopted in 2015, which forcibly clears keys from memory before switching to sleep mode.
Source: opennet.ru
