Is it safe to include memory addresses in a program’s output?

Question

I’m writing a program. The input is a complex data structure in memory. The output is an HTML report that contains: (1) a representation of the structure; (2) textual annotations that refer to objects in the structure.

In order to link the annotations to parts of the structure, I use the objects’ memory addresses as anchors. Thus, memory addresses end up directly in the generated HTML code.

Could this be in any way dangerous?

The reports are mostly for personal use, but sometimes they might be shared.

The program can be used as a library, inside another process’s memory space. However, the input objects are constructed specially for this purpose, and will normally be garbage-collected once the report is finished.

I was thinking about obfuscating the addresses with MD5—would that be somehow better?

Answer 1

Purely from a programming point of view, instead of using an objects memory address to link these two pieces of data, you really should be generating an index number and using that to refer between the structure and your annotation.

I can't see any reason why it would be dangerous though to include the addresses in the report, since as soon as your program terminates the address space is freed by the OS. While it may not be zeroed out (data may remain in memory until overwritten), you probably aren't at risk of exploitation.

Answer 2

It may be dangerous. If your program manipulates confidential data that doesn't end up in the report, then the memory addresses may reveal information about the confidential data. Exploiting this data is likely to be difficult; the attacker would have to have a good working knowledge of what the program does, and they'd only obtain partial information, mostly about the size and number of some data elements.

For example, condider this pseudocode which analyzes a patient's record to determine whether they are fit for work:

struct patient_record_entry entries* = malloc(entry_count * sizeof(struct patient_record_entry));
char *employer_name = malloc(employer_name_length);
// read patient data from file
// analyze patient record to determine fitness for work
bool is_patient_fit = …;
printf("<patient><name>%s</name><employer>%s</employer><fit>%d</fit></patient>\n",
       patient.name, employer_name, is_patient_fit);

Revealing the addresses of employer_name and entries reveals the number of entries in the patient's record (employer_name - entries minus a constant related to memory management) in the not so unlikely case where the two memory blocks are consecutive. This leaks more information about the patient than what is supposed to be in the output.

Answer 3

First, what would you lose by hashing those values? I suspect the code isn't particularly performance critical and the speed impact would be relatively minor. If there isn't a big downside it is probably worth doing.

As to what the security impact may be - many operating systems use address space layout randomisation (ASLR) to help mitigate against certain types of attacks. In the case that your program produces this output and exits it's probably not a big deal as the leaked addresses are for a now dead process, but as you mention a library that could leak addresses for a process that continues running there may be an issue there. Leaking the info doesn't directly create a vulnerability, but may make it easier to exploit one that does exist.