I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and Linux (though they do that, they don't guarantee that this will happen), but a responsibility of OSes with a certificate allowing it to work with classified information.
Is it possible to make the following attack on another (maybe more privileged) process?
map enough memory pages and start consuming enough CPU time to prevent zeroing thread, which has the lowest priority (at least on Windows), from getting CPU time.
another process places sensitive data into memory
context switch occurs
we ask the OS for a memory page, OS evicts that process' page and gives us the new page backed by the same page frame without zeroing it.
we scan the page for secrets.
He also states that there are ways to read another process' memory messing with
mmap, its flags and physical addresses on Linux. Do you know any? Is it really possible to get another process' memory on Linux, for example memory of the process of another user or SELinux domain? If they are it looks like a very dangerous vulnerability.