Plaintext Storage in Memory| ID: 316 | Date: (C)2012-05-14 (M)2022-10-10 |
| Type: weakness | Status: DRAFT |
| Abstraction Type: Variant |
Description
Storing sensitive data in plaintext in memory makes the data
more easily accessible than if encrypted. This significantly lowers the
difficulty of exploitation by attackers.
Extended DescriptionThe sensitive memory might be saved to disk, stored in a core dump, or
remain uncleared if the application crashes, or if the programmer does not
clear the memory before freeing it.
Applicable PlatformsLanguage Class: All
Time Of Introduction
Common Consequences
| Scope | Technical Impact | Notes |
|---|
| Confidentiality | Read memory | |
Detection MethodsNone
Potential Mitigations
| Phase | Strategy | Description | Effectiveness | Notes |
|---|
| | | Sensitive information should not be stored in plaintext in memory.
Even if heavy fortifications are in place, sensitive data should be
encrypted to prevent the risk of losing confidentiality. | | |
RelationshipsThis could be a resultant weakness, e.g. if the compiler removes code that
was intended to wipe memory.
| Related CWE | Type | View | Chain |
|---|
| CWE-316 ChildOf CWE-895 | Category | CWE-888 | |
Demonstrative ExamplesNone
Observed Examples
- CVE-2001-1517 : Sensitive authentication information in cleartext in memory.
- BID:10155 : Sensitive authentication information in cleartext in memory.
- CVE-2001-0984 : Password protector leaves passwords in memory when window is minimized, even when "clear password when minimized" is set.
- CVE-2003-0291 : SSH client does not clear credentials from memory.
For more examples, refer to CVE relations in the bottom box.
White Box Definitions None
Black Box Definitions None
Taxynomy Mappings
| Taxynomy | Id | Name | Fit |
|---|
| PLOVER | | Plaintext Storage in Memory | |
References:None
