Page History

...

Dynamic memory managers are not required to clear freed memory and generally do not because of the additional runtime overhead. Furthermore, dynamic memory managers are free to reallocate this same memory. As a result, it is possible to accidentally leak sensitive information if it is not cleared before calling a function that frees dynamic memory. Programmers also cannot rely on memory being cleared during allocation. (See recommendation MEM09-C. Do not assume memory allocation functions initialize memory.)

...

The calloc() function ensures that the newly allocated memory has also been cleared. Because sizeof(char) is guaranteed to be 1, this solution does not need to check for a numeric overflow as a result of using calloc(). (See recommendation MEM07-C. Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t.)

See recommendation MSC06-C. Be aware of compiler optimization when dealing with sensitive data for a definition and discussion of using the memset_s() function.

...

Using realloc() to resize dynamic memory may inadvertently expose sensitive information, or it may allow heap inspection as described in the Fortify Taxonomy: Software Security Errors [Fortify 2006] and NIST's Source Code Analysis Tool Functional Specification [Black 2007]. When realloc() is called, it may allocate a new, larger object, copy the contents of secret to this new object, free() the original object, and assign the newly allocated object to secret. However, the contents of the original object may remain in memory.

...

The secret_size is tested to ensure that the integer multiplication (secret_size * 2) does not result in an integer overflow. (See rule INT32-C. Ensure that operations on signed integers do not result in overflow.)

Compliant Solution

A compliant program cannot rely on realloc() because it is not possible to clear the memory prior to memory before the call. Instead, a custom function must be used that operates similar similarly to realloc() but sanitizes sensitive information as heap-based buffers are resized. Again, this is done by overwriting the space to be deallocated with '\0' characters.

...

The calloc() function ensures that the newly allocated memory has also been clearedmemory is also cleared. Because sizeof(char) is guaranteed to be 1, this solution does not need to check for a numeric overflow as a result of using calloc(). (See recommendation MEM07-C. Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t.)

...

In practice, this type of security flaw can expose sensitive information to unintended parties. The Sun tarball vulnerability discussed in Secure Coding Principles & Practices: Designing and Implementing Secure Applications [Graf 2003] and Sun Security Bulletin #00122 [Sun] shows a violation of this recommendation, leading to sensitive data being leaked. Attackers may also be able to leverage this defect to retrieve sensitive information using techniques such as heap inspection.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

MITRE CWE: CWE-226, "Sensitive Information Uncleared Before Releaseinformation uncleared before release"

MITRE CWE: CWE-244: "Failure to Clear Heap Memory Before Release ('Heap Inspection')clear heap memory before release ("heap inspection")"

ISO/IEC 9899:19992011 Section 7.2022.3, "Memory management functions"

ISO/IEC TR 24772 "XZK Sensitive Information Uncleared Before Useinformation uncleared before use"

Bibliography

[Black 2007]
[Fortify 2006]
[Graff 2003]

...