wolfHSM Hardening Fixes#425

Open

aidangarske wants to merge 13 commits into

wolfSSL:mainfrom

aidangarske:fenrir-high-zeroize-bounds

Commits on Jun 25, 2026

F-6031 - Zeroize SHE plaintext key in client comm buffer after send
aidangarske
committed
F-5475 - Zeroize prior credential material before storing new value
aidangarske
committed
F-5141 - Bound config file path copy to prevent stack overflow
aidangarske
committed
F-5142 - Bound whnvmtool config path copy to prevent stack overflow
aidangarske
committed
F-5139 - Add O_EXCL to SHM create to close name TOCTOU
aidangarske
committed
F-4235 - Propagate VERIFY_ACERT_DMA error into response before serialize
aidangarske
committed
F-6029 - Zeroize plaintext key in KeyWrap request comm buffer
aidangarske
committed
F-6030 - Zeroize unwrapped plaintext key in export response buffer
aidangarske
committed
F-5473 - Zeroize imported key bytes in client cache request buffer
aidangarske
committed
F-5474 - Zeroize exported key bytes in client response buffer
aidangarske
committed
F-6207 - Subtract response header from HKDF and CMAC-KDF output bound
aidangarske
committed
F-4329 - Force 64-bit arithmetic in AES-GCM needed_size check
aidangarske
committed
F-4978 - Bound AES-GCM response output and tag to comm buffer
aidangarske
committed