CWE

Improper Clearing of Heap Memory Before Release ('Heap Inspection')

ID: 244		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: DRAFT
Abstraction Type: Variant

Description

Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

Extended Description

When sensitive data such as a password or an encryption key is not removed from memory, it could be exposed to an attacker using a "heap inspection" attack that reads the sensitive data using memory dumps or other methods. The realloc() function is commonly used to increase the size of a block of allocated memory. This operation often requires copying the contents of the old memory block into a new and larger block. This operation leaves the contents of the original block intact but inaccessible to the program, preventing the program from being able to scrub sensitive data from memory. If an attacker can later examine the contents of a memory dump, the sensitive data could be exposed.

Applicable Platforms
Language: C
Language: C++

Time Of Introduction

• Implementation

Common Consequences

Scope	Technical Impact	Notes
Confidentiality Other	Read memory Other	Be careful using vfork() and fork() in security sensitive code. The process state will not be cleaned up and will contain traces of data from past use.

Detection Methods
None

Potential Mitigations
None

Relationships

Related CWE	Type	View	Chain
CWE-244 ChildOf CWE-895	Category	CWE-888

Demonstrative Examples   (Details)

1. The following code calls realloc() on a buffer containing sensitive data:

White Box Definitions
A weakness where code path has:
1. start statement that stores information in a buffer
2. end statement that resize the buffer and
3. path does not contain statement that performs cleaning of the buffer

Black Box Definitions
None

Taxynomy Mappings

Taxynomy	Id	Name	Fit
7 Pernicious Kingdoms		Heap Inspection
CERT C Secure Coding	MEM03-C	Clear sensitive information stored in reusable resources returned for reuse
CERT C++ Secure Coding	MEM03-CPP	Clear sensitive information stored in returned reusable resources

References:
None