Clear cached PIN entry as part of pin set command

When a PIN is changed using the pin set command, the last action is to
confirm the operation with the previously used PIN. This step will cause
this PIN, which is now stale and no longer valid, to be cached, which in
turn can cause follow up command using the same PIN type to use this
wrong cached entry for authentication.
To fix this problem, this change explicitly clear the PIN entry from the
cache after the PIN has been changed.

1 files changed, 6 insertions, 1 deletions

diff --git a/nitrocli/src/commands.rs b/nitrocli/src/commands.rs
index a81859c..7bb314c 100644
--- a/nitrocli/src/commands.rs
+++ b/nitrocli/src/commands.rs
@@ -725,7 +725,12 @@ pub fn pin_set(ctx: &mut args::ExecCtx<'_>, pin_type: pinentry::PinType) -> Resu
       pinentry::PinType::Admin => device.change_admin_pin(&current_pin, &new_pin),
       pinentry::PinType::User => device.change_user_pin(&current_pin, &new_pin),
     },
-  )
+  )?;
+
+  // We just changed the PIN but confirmed the action with the old PIN,
+  // which may have caused it to be cached. Since it no longer applies,
+  // make sure to evict the corresponding entry from the cache.
+  pinentry::clear(&pin_entry)
 }
 
 /// Unblock and reset the user PIN.