动态分配的内存信息泄漏安全问题

research security

测试代码

#include<cstdlib>
#include<cstdio>
typedef unsigned char uint8_t;
const static unsigned int len = 2048;
const static unsigned int outLen = 128;
int main()
{
    uint8_t * pointer = (uint8_t *)malloc(len);
    if (NULL == pointer)
        return -1;
    for( size_t i = 0; i < len; ++i ) 
        pointer[i] = (i + 0x17) * 0x11;
    for( size_t i = 0; i < outLen; ++i ) 
        printf( "%02x ", pointer[i] );
    puts("");
    free(pointer);
    for( size_t i = 0; i < outLen; ++i ) 
        printf( "%02x ", pointer[i] );
    puts("");
    return 0;
}

测试结果

windows 10 x64 VC 2015
C:\Users\Admin\Desktop>f
87 98 a9 ba cb dc ed fe 0f 20 31 42 53 64 75 86 97 a8 b9 ca db ec fd 0e 1f 30 41 52 63 74 85 96 a7 b8 c9 da eb fc 0d 1e 2f 40 51 62 73 84 95 a6 b7 c8 d9 ea fb 0c 1d 2e 3f 50 61 72 83 94 a5 b6 c7 d8 e9 fa 0b 1c 2d 3e 4f 60 71 82 93 a4 b5 c6 d7 e8 f9 0a 1b 2c 3d 4e 5f 70 81 92 a3 b4 c5 d6 e7 f8 09 1a 2b 3c 4d 5e 6f 80 91 a2 b3 c4 d5 e6 f7 08 19 2a 3b 4c 5d 6e 7f 90 a1 b2 c3 d4 e5 f6
90 b0 d9 00 c0 00 d9 00 0f 20 31 42 53 64 75 86 97 a8 b9 ca db ec fd 0e 1f 30 41 52 63 74 85 96 a7 b8 c9 da eb fc 0d 1e 2f 40 51 62 73 84 95 a6 b7 c8 d9 ea fb 0c 1d 2e 3f 50 61 72 83 94 a5 b6 c7 d8 e9 fa 0b 1c 2d 3e 4f 60 71 82 93 a4 b5 c6 d7 e8 f9 0a 1b 2c 3d 4e 5f 70 81 92 a3 b4 c5 d6 e7 f8 09 1a 2b 3c 4d 5e 6f 80 91 a2 b3 c4 d5 e6 f7 08 19 2a 3b 4c 5d 6e 7f 90 a1 b2 c3 d4 e5 f6
Fedora 26 x64 for both Clang 4.0.1 and GCC 7.1.1
[root@localhost ~]# ./a.out
87 98 a9 ba cb dc ed fe 0f 20 31 42 53 64 75 86 97 a8 b9 ca db ec fd 0e 1f 30 41 52 63 74 85 96 a7 b8 c9 da eb fc 0d 1e 2f 40 51 62 73 84 95 a6 b7 c8 d9 ea fb 0c 1d 2e 3f 50 61 72 83 94 a5 b6 c7 d8 e9 fa 0b 1c 2d 3e 4f 60 71 82 93 a4 b5 c6 d7 e8 f9 0a 1b 2c 3d 4e 5f 70 81 92 a3 b4 c5 d6 e7 f8 09 1a 2b 3c 4d 5e 6f 80 91 a2 b3 c4 d5 e6 f7 08 19 2a 3b 4c 5d 6e 7f 90 a1 b2 c3 d4 e5 f6
38 6b 99 11 36 7f 00 00 38 6b 99 11 36 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a7 b8 c9 da eb fc 0d 1e 2f 40 51 62 73 84 95 a6 b7 c8 d9 ea fb 0c 1d 2e 3f 50 61 72 83 94 a5 b6 c7 d8 e9 fa 0b 1c 2d 3e 4f 60 71 82 93 a4 b5 c6 d7 e8 f9 0a 1b 2c 3d 4e 5f 70 81 92 a3 b4 c5 d6 e7 f8 09 1a 2b 3c 4d 5e 6f 80 91 a2 b3 c4 d5 e6 f7 08 19 2a 3b 4c 5d 6e 7f 90 a1 b2 c3 d4 e5 f6

测试结论

free并不会把一段较长的分配的内存清理掉，这导致了诸如AES round key这样的敏感数据如果被分配到heap上，在free之前没有zeroMemory，就会产生信息泄漏的风险

Links:

Zeroing buffers is insufficient
http://www.daemonology.net/blog/2014-09-06-zeroing-buffers-is-insufficient.html

Is free() zeroing out memory?
https://stackoverflow.com/questions/30683519/is-free-zeroing-out-memory