An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, it has temper-proof sensors. If tampering is detected, the application exists (but does not wipe all process memory before doing it). I cannot change this behavior.

Does the Linux kernel wipes the released process memory by default? Do any Linux distro do it? Is there a patch to do it?

By wiping I mean zero fill, or multiple-pass rewriting.

2 Answers 2


Linux zeroes out (i.e. fills with zeros) all pages of memory not when they are released, but when they are given to another process. Thus, no process may obtain data excerpts from another process. However, the pages will retain their old contents until they are reused. I am not aware of any patch which does the zeroing upon page release (Edit: as @user2313067 points out in his answer, the PaX patch offers this option, at a cost which may or may not be a problem on any given system); on a general basis, it would be detrimental to performance because it would fill caches with the zeros, evicting more "useful" data (and that's not counting swap space, which your embedded device probably lacks, but most Linux systems out there have swap).

You can force a sort-of wipeout of data by simply allocating every possible page from another process. Something like this:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

    for (;;) {
        void *x = malloc(2000);
        if (x == NULL) {
        memset(x, 'T', 2000);
    return 0;

If you run this program as root, then it grabs all available memory and fills it (in order to force actual allocation), exiting only when there is no memory left. Running as root is needed because the kernel reserves the last few pages to root.

Note that filling memory up triggers OOM conditions, at which point the kernel feels allowed to shoot processes in order to make some room. This happens only when there is no free page left, i.e. the state that you want to achieve (no free page left means that all old pages have been reallocated, and therefore zeroed out). It is a kind of suicide for the OS, because the OOM handling code may kill some essential processes (it tries not to, but hey, these are just heuristics). However, this seems appropriate in your case: if tampering is detected, the device has no choice except honourable disembowelment.

So you just have to launch your critical application in a wrapper (a simple script) which launches the above program when the critical application exits (presumably because of detected tampering).

  • Wiping private bytes(those not shared with other processes) on process termination should hurt caches. Sep 11, 2013 at 19:33
  • Indeed, "it would be detrimental to performance because it would fill caches with the zeros" Sep 11, 2013 at 19:46
  • Unless you use non-temporal stores, in which case the caches will be unaffected
    – CAFxX
    Sep 3, 2016 at 2:04
  • This may not work on systems that have KSM (Kernel Samepage Merging) enabled.
    – forest
    Mar 12, 2018 at 12:30
  • 1
    While this answer is correct for normal Linux systems, note that some embedded systems may set MAP_UNINITIALIZED and CONFIG_MMAP_ALLOW_UNINITIALIZED, which means that applications may receive uninitialised pages containing the memory of a previous process. If you are working with sensitive data on these exotic embedded systems, you'll want to be aware of this potential security problem.
    – Lie Ryan
    Sep 22, 2018 at 8:11

Grsecurity has PAX_MEMORY_SANITIZE to do this. See the option on this page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .