1

Functions like bzero(), explicit_bzero() and ZeroMemory are designed to delete sensitive data from RAM (Like keys). Can I use explicit_bzero() to delete entire RAM (e.g. 2 GB RAM)? Is this a feasible approach? Is there any kind of significant limitation with this, like slowing down or crashing system?

Improve this question

2 Answers 2

Reset to default
2

If you could zero all of your memory, then yes it would cause the system to crash immediately, as none of the OS data or code would exist anymore, the system would not be capable of continuing to run in any capacity.

But you would not be able to do this just by calling bzero from a userspace application. The kernel generally restricts an applications memory access to within its own address space, so this would not be allowed.

Improve this answer
3
  • Then what can I do to erase all related data from a previous session? Let say I want to make sure all data are erased from a server's RAM after the user closed his applications. There should be possibly a way to touch unrestricted data and tmp applications data (not os related) .
    – Kiavash Satvat
    Commented Oct 6, 2017 at 14:14
  • If you're using Linux there are kernel extensions such as GRSecurity that can achieve this, see this answer for example. Not sure about other OSs.
    – Sean Burton
    Commented Oct 6, 2017 at 14:46
  • Grsecurity cannot wipe all system memory, only freed data. Wiping all memory would require a kernel patch that erased memory in a single thread with SMP disabled, e.g. during a panic.
    – forest
    Commented Dec 10, 2017 at 11:04
1

These are user-space functions. This means anything you can erase there affects only the current process and only memory pages belonging to the process which are writable (i.e. usually no program code). Trying to delete memory not mapped into the process address space will just crash the application (i.e. segmentation fault).

Can I use explicit_bzero() to delete entire RAM (e.g. 2 GB RAM)?

Since a process does not own the whole RAM (the kernel does) it cannot be deleted from a process.

Improve this answer
1
  • 1
    Well you could wipe a good portion of memory by using kexec to boot into a second kernel and then having a userspace program allocate as much memory as it can and then wipe it with explicit_bzero().
    – forest
    Commented Nov 1, 2018 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .