tech-security archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Zero it if you're going to copy it out.

To: Roger Pau Monne <roger.pau%citrix.com@localhost>
Subject: Zero it if you're going to copy it out.
From: Thor Lancelot Simon <tls%panix.com@localhost>
Date: Mon, 25 Jun 2012 09:20:47 -0400

On Mon, Jun 25, 2012 at 02:16:33PM +0100, Roger Pau Monne wrote:
> 
> Yes, it doesn't hurt to zero memory if returning it to the user. Who
> knows what might be there previously.

I'm sorry, I can't let this go.

This is not a case of "it doesn't hurt" -- it's a case of "it's absolutely
necessary".  It is completely unacceptable to leak the contents of kernel
memory to the user!

Thor

Follow-Ups:
- crypto_memset (was: Re: Zero it if you're going to copy it out.)
  - From: Jean-Yves Migeon
- Re: Zero it if you're going to copy it out.
  - From: Cherry G . Mathew

Prev by Date: NetBSD Security Advisory 2012-003: Intel processors sysret to non-canonical address behaviour
Next by Date: Re: Zero it if you're going to copy it out.
Previous by Thread: NetBSD Security Advisory 2012-003: Intel processors sysret to non-canonical address behaviour
Next by Thread: Re: Zero it if you're going to copy it out.
Indexes:

Home | Main Index | Thread Index | Old Index