intel / intel/intel-sgx-ssl

Memory leak in EVP_PKEY_decrypt()

Open
#153 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Assembly
Stars
245
Forks
84
Avg merge
2d 12h
Merged PRs (30d)
4

Description

Using EVP_PKEY_decrypt() with an RSA private key leaks approximately 1KB of enclave heap for each call.

A zip file with a simple enclave application that demonstrates the leak is attached. Note line 304 of rsaencryption.c:

// set this to 1, and the leak disappears
#if 0
int result = 1;
#else
int result = EVP_PKEY_decrypt( pkeyCtx, plaintext, &bytesDecrypted, ciphertext, ciphertextLen );
#endif

[RSALeak.zip](https://github.com/intel/intel-sgx-ssl/files/11056956/RSALeak.zip)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.