{"id":182443,"date":"2026-07-02T22:53:28","date_gmt":"2026-07-02T20:53:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/problemy-s-ochistkoj-klyuchej-shifrovaniya-diska-iz-ozu-pri-perehode-linux-v-zhdushhij-rezhim"},"modified":"2026-07-02T22:53:28","modified_gmt":"2026-07-02T20:53:29","slug":"problemy-s-ochistkoj-klyuchej-shifrovaniya-diska-iz-ozu-pri-perehode-linux-v-zhdushhij-rezhim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/problemy-s-ochistkoj-klyuchej-shifrovaniya-diska-iz-ozu-pri-perehode-linux-v-zhdushhij-rezhim","title":{"rendered":"Issues with clearing disk encryption keys from RAM when Linux enters sleep mode.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
During the porting of the cryptsetup-suspend toolkit for NixOS, an error was discovered in the LUKS (Linux Unified Key Setup) disk encryption subsystem, which resulted in the failure to clear encryption keys from memory when the system entered sleep mode, starting with Linux kernel 6.9 (the problematic commit) released in May 2024. <\/p>\n
The cryptsetup-suspend tool is used in Debian for automatically locking LUKS partitions before entering sleep mode. It is assumed that in the event of a laptop theft, when put into sleep mode, the attacker will be deprived of access to data, as a password will be required to regain access to encrypted data upon waking. Due to a bug in the Linux kernel, after locking the LUKS partition with the command «cryptsetup luksSuspend», the keys were not cleared from RAM and remained visible through \/proc\/keys, which allowed an attacker to extract them, for example, via a «cold reboot», and use them to access the data. <\/p>\n
The lack of key clearance was identified during debugging a race condition that caused issues with entering sleep mode. This bug arose after the refactoring in kernel 6.9, whereby keys were tied to the calling thread and were supposed to be deleted upon its completion, but remained in memory instead. A one-line patch has been proposed for inclusion in the Linux kernel to correct this oversight. <\/p>\n
This patch has not been accepted into the kernel, as a flaw was identified \u2014 the patch only works for physical storage devices and does not function for virtual loop devices. Instead of fixing the issue on the kernel side, the developers of the cryptsetup tool proposed a workaround for clearing the keys. This change has already been accepted and will be included in the cryptsetup release 2.8.7. <\/p>\n