Re: A Famous Security Bug

On 20/03/2024 19:54, Kaz Kylheku wrote:

On 2024-03-20, Stefan Ram <ram@zedat.fu-berlin.de> wrote:

   A "famous security bug":
>
void f( void )
{ char buffer[ MAX ];
   /* . . . */
   memset( buffer, 0, sizeof( buffer )); }
>
   . Can you see what the bug is?

 I don't know about "the bug", but conditions can be identified under
which that would have a problem executing, like MAX being in excess
of available automatic storage.
 If the /*...*/ comment represents the elision of some security sensitive
code, where the memset is intended to obliterate secret information,
of course, that obliteration is not required to work.
 After the memset, the buffer has no next use, so the all the assignments
performed by memset to the bytes of buffer are dead assignments that can
be elided.
 To securely clear memory, you have to use a function for that purpose
that is not susceptible to optimization.
 If you're not doing anything stupid, like link time optimization, an
external function in another translation unit (a function that the
compiler doesn't recognize as being an alias or wrapper for memset)
ought to suffice.
 

Using LTO is not "stupid".  Relying on people /not/ using LTO, or not using other valid optimisations, is "stupid".
/Really/ dealing with this kind of potential data leakage is a multi-faceted problem.  Does it matter if you zero out this buffer, if that is just in the cache and the original password data is still in the ram ready to be read with a Rowhammer attack?   Or if there is a copy somewhere else in code that used it?
Of course it is important to deal with possible security issues at every practical point, so zeroing out this buffer is part of the solution - as long as no one thinks that using C23's memset_explicit(), or similar functions, are somehow complete fixes.
Calling an external function in another translation unit, however, is not a way to guarantee particular effects.  Using volatile accesses is better (if you don't have a suitable function with the right guarantees for your target OS and/or C version).  There are also compiler-specific ways, such as adding "__asm__("" : "+m" (buffer));" after the memset.