Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, it has temper-proof sensors. If tampering is detected, the application exists (but does not wipe all process memory before doing it). I cannot change this behavior.

Does the Linux kernel wipes the released process memory by default? Do any Linux distro do it? Is there a patch to do it?

By wiping I mean zero fill, or multiple-pass rewriting.

Thanks.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Linux zeroes out (i.e. fills with zeros) all pages of memory not when they are released, but when they are given to another process. Thus, no process may obtain data excerpts from another process. However, the pages will retain their old contents until they are reused. I am not aware of any patch which does the zeroing upon page release (Edit: as @user2313067 points out in his answer, the PaX patch offers this option, at a cost which may or may not be a problem on any given system); on a general basis, it would be detrimental to performance because it would fill caches with the zeros, evicting more "useful" data (and that's not counting swap space, which your embedded device probably lacks, but most Linux systems out there have swap).

You can force a sort-of wipeout of data by simply allocating every possible page from another process. Something like this:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(void)
{
    for (;;) {
        void *x = malloc(2000);
        if (x == NULL) {
            break;
        }
        memset(x, 'T', 2000);
    }
    return 0;
}

If you run this program as root, then it grabs all available memory and fills it (in order to force actual allocation), exiting only when there is no memory left. Running as root is needed because the kernel reserves the last few pages to root.

Note that filling memory up triggers OOM conditions, at which point the kernel feels allowed to shoot processes in order to make some room. This happens only when there is no free page left, i.e. the state that you want to achieve (no free page left means that all old pages have been reallocated, and therefore zeroed out). It is a kind of suicide for the OS, because the OOM handling code may kill some essential processes (it tries not to, but hey, these are just heuristics). However, this seems appropriate in your case: if tampering is detected, the device has no choice except honourable disembowelment.

So you just have to launch your critical application in a wrapper (a simple script) which launches the above program when the critical application exits (presumably because of detected tampering).

share|improve this answer
    
Wiping private bytes(those not shared with other processes) on process termination should hurt caches. –  CodesInChaos Sep 11 '13 at 19:33
    
Indeed, "it would be detrimental to performance because it would fill caches with the zeros" –  Thomas Pornin Sep 11 '13 at 19:46

GRSecurity has PAX_MEMORY_SANITIZE to do this. See the option on this page.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.