Analyze and fix vulnerabilities from the cryptor

[putsi]

Find out what kind of vulnerabilities the module contains and fix these vulnerabilities. Remember to document the process.

[putsi]

Following vulnerabilities still exist on the current source code:

• Some consider RC4 as weak encryption, this could use something else (Linux Crypto API?).

Following vulnerabilities have been fixed:

• Race conditions:
  • Multiple users using the device at same time.
  • Read-Write-Read-Write.
  • Read-SetKey-Write-SetKey.
  • SetKey-ReadKey-SetKey-ReadKey.
• Encryption key input doesn't sanitize/validate data.
• Sprintf-overflow.
• Users can read the encryption key (information leak).
• Possible information leaks on swapping.
  • Not a problem as kernel module will not be swapped ever.
• Encryption key stays on memory after device is closed.
• Encryption key stays on memory after device is removed.
• Encryption key truncates to ~8 characters.
• IOCTL-calls could be accessed by multiple users concurrently.
• Read-method doesn't respect length-parameter.
• Write-method doesn't respect length-parameter.