Consumed bootstrap token is not zeroized in memory #73

New Issue

Skipper · 2026-04-05T16:23:12Z

Skipper commented

2026-04-05 16:23:12 +00:00

Info

Severity: HIGH
Attack vector: local malicious process

Impact

Allows recovery of a consumed bootstrap token from process memory, enabling later unauthorized bootstrap or registration if the token or related state remains usable.

Description

When the token is consumed, the code drops the String instead of zeroizing it. Rust's allocator does not guarantee that freed heap memory is overwritten, so the token bytes can remain in process memory until reused by a future allocation. Temporary copies are also heap-allocated and left intact.

Example flow

Let the legitimate flow consume the bootstrap token.
Obtain a memory dump, crash report, or equivalent process-memory disclosure.
Recover the stale token bytes from freed heap memory.
Reuse the token or exploit related bootstrap state.

Mitigation

Store tokens in zeroizing containers, zeroize temporary copies, and avoid returning cloned token values.

# Info **Severity**: **HIGH** Attack vector: local malicious process ## Impact Allows recovery of a consumed bootstrap token from process memory, enabling later unauthorized bootstrap or registration if the token or related state remains usable. ## Description When the token is consumed, the code drops the `String` instead of zeroizing it. Rust's allocator does not guarantee that freed heap memory is overwritten, so the token bytes can remain in process memory until reused by a future allocation. Temporary copies are also heap-allocated and left intact. ## Example flow 1. Let the legitimate flow consume the bootstrap token. 2. Obtain a memory dump, crash report, or equivalent process-memory disclosure. 3. Recover the stale token bytes from freed heap memory. 4. Reuse the token or exploit related bootstrap state. ## Mitigation Store tokens in zeroizing containers, zeroize temporary copies, and avoid returning cloned token values.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#73