Since Linux 6.9, the tool that locks the laptop's drive on suspend had been silently failing to wipe disk-encryption keys from memory [1]. This vulnerability, discovered by Ingo Blechschmidt, affects users who rely on full-disk encryption (LUKS) to protect their data [2]. The issue arises from a sensible and useful refactoring in the Linux kernel, which had an unexpected long-range interaction with the encryption code [3]. The fix for this issue is a one-line patch [4].
To address this vulnerability, Blechschmidt has announced an experimental secure suspend-to-RAM for NixOS, which resurrects an old kernel patch by Pali Rohár to wipe the LUKS encryption keys on suspend [5]. This project fixes the issue by providing a secure way to suspend laptops while protecting sensitive data. The vulnerability highlights the importance of regularly reviewing and updating security mechanisms to ensure the protection of sensitive data [6].
Sources
- https://mathstodon.xyz/@iblech/116769502749142438
- https://lore.kernel.org/linux-pm/1428254419-7334-1-git-send-email-pali.rohar@gmail.com/
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a28d893eb3270cf62c10dd8777af0d8452cdc072
- https://lore.kernel.org/all/ajKwRtP8izwRsMmv@quasitopos/
- https://codeberg.org/iblech/secure-suspend
- https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf
