Date: Mon, 25 Apr 2011 15:18:46 +0100 From: RW <rwmaillists@googlemail.com> To: freebsd-questions@freebsd.org Subject: Re: Password theft from memory? Message-ID: <20110425151846.0a5359fd@gumby.homeunix.com> In-Reply-To: <BANLkTin_S%2BBRWu79AH16tPdgZd%2BUgZQAzQ@mail.gmail.com> References: <BANLkTimJWAxW_4OmoeBQrvDDLjD-5Vr5hQ@mail.gmail.com> <BANLkTin_S%2BBRWu79AH16tPdgZd%2BUgZQAzQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 24 Apr 2011 19:53:41 +0200 "C. P. Ghost" <cpghost@cordula.ws> wrote: > On Sun, Apr 24, 2011 at 7:10 PM, Modulok <modulok@gmail.com> wrote: > > I don't know if this is a problem on FreeBSD... > > > > Process A requests memory. > > Process A Stores a plaintext password in memory or other sensitive > > data. Process A terminates and the memory is reclaimed by kernel. > > > > Process B requests a *huge* chunk of memory. > > Process B crawls the uninitialized memory, looking for ProcessA's > > previously stored password. > > > > Does anyone know if this is even possible on FreeBSD? > > Please correct me if I'm wrong (I didn't check the sources), but... > > short answer: it shouldn't happen, because pages allocated to a new > process are zero-filled by the kernel (lazily via zero-fill page > faults when process B crawls the memory the first time). I don't believe the heap is allocated zeroed pages. The kernel does allocate such pages to the BSS segment, but that's because it holds zeroed data such as C static variables. AFAIK it's the responsibly of the programmer to avoid data leaking. Passwords are commonly overwritten as soon as they no longer needed. I think geli keeps persistent key information in kernel wired-memory.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110425151846.0a5359fd>