CWE Rule 316
Description
Rule Description
The product stores sensitive information in cleartext in memory.
Polyspace Implementation
The rule checker checks for these issues:
Sensitive heap memory not cleared before release
Uncleared sensitive data in stack
Examples
This issue occurs when dynamically allocated memory contains sensitive data and you do not clear the data before you free the memory.
If the memory zone is reallocated, an attacker can still inspect the sensitive data in the old memory zone.
Before calling free
, clear out the sensitive
data using memset
or SecureZeroMemory
.
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <pwd.h>
void sensitiveheapnotcleared(const char * my_user) {
struct passwd* result, pwd;
long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
char* buf = (char*) malloc(1024);
getpwnam_r(my_user, &pwd, buf, bufsize, &result);
free(buf); //Noncompliant
}
In this example, the function uses a buffer of passwords and
frees the memory before the end of the function. However, the data
in the memory is not cleared by using the free
command.
One possible correction is to write over the data to clear out
the sensitive information. This example uses memset
to
write over the data with zeros.
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <pwd.h>
#include <assert.h>
#define isNull(arr) for(int i=0;i<(sizeof(arr)/sizeof(arr[0]));i++) assert(arr[i]==0)
void sensitiveheapnotcleared(const char * my_user) {
struct passwd* result, pwd;
long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
char* buf = (char*) malloc(1024);
if (buf) {
getpwnam_r(my_user, &pwd, buf, bufsize, &result);
memset(buf, 0, (size_t)1024);
isNull(buf);
free(buf);
}
}
This issue occurs when statically allocated memory contains sensitive data and you do not clear the data before exiting a function or program.
Leaving sensitive information in your stack, such as passwords or user information, allows an attacker additional access to the information after your program has ended.
Before exiting a function or program, clear out the memory zones
that contain sensitive data by using memset
or SecureZeroMemory
.
#include <unistd.h>
#include <sys/types.h>
#include <pwd.h>
void bug_sensitivestacknotcleared(const char * my_user) {
struct passwd* result, pwd;
long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
char buf[1024] = "";
getpwnam_r(my_user, &pwd, buf, bufsize, &result);
} //Noncompliant
In this example, a static buffer is filled with password information. The program frees the stack memory at the end of the program. However, the data is still accessible from the memory.
One possible correction is to write over the memory before exiting
the function. This example uses memset
to clear
the data from the buffer memory.
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <pwd.h>
#include <assert.h>
#define isNull(arr) for(int i=0;i<(sizeof(arr)/sizeof(arr[0]));i++) assert(arr[i]==0)
void corrected_sensitivestacknotcleared(const char * my_user) {
struct passwd* result, pwd;
long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
char buf[1024] = "";
getpwnam_r(my_user, &pwd, buf, bufsize, &result);
memset(buf, 0, (size_t)1024);
isNull(buf);
}
Check Information
Category: Others |
Version History
Introduced in R2024a
See Also
External Websites
MATLAB Command
You clicked a link that corresponds to this MATLAB command:
Run the command by entering it in the MATLAB Command Window. Web browsers do not support MATLAB commands.
웹사이트 선택
번역된 콘텐츠를 보고 지역별 이벤트와 혜택을 살펴보려면 웹사이트를 선택하십시오. 현재 계신 지역에 따라 다음 웹사이트를 권장합니다:
또한 다음 목록에서 웹사이트를 선택하실 수도 있습니다.
사이트 성능 최적화 방법
최고의 사이트 성능을 위해 중국 사이트(중국어 또는 영어)를 선택하십시오. 현재 계신 지역에서는 다른 국가의 MathWorks 사이트 방문이 최적화되지 않았습니다.
미주
- América Latina (Español)
- Canada (English)
- United States (English)
유럽
- Belgium (English)
- Denmark (English)
- Deutschland (Deutsch)
- España (Español)
- Finland (English)
- France (Français)
- Ireland (English)
- Italia (Italiano)
- Luxembourg (English)
- Netherlands (English)
- Norway (English)
- Österreich (Deutsch)
- Portugal (English)
- Sweden (English)
- Switzerland
- United Kingdom (English)