Conversation

Question: what scenarios does zero-memory-on-free mitigate that zero-mem-on-malloc doesn't? I have hard time imagining any... For accesses via new ptr it doesn't matter. Via old ptr - most likely doesn't matter too (could have been accesses while the object is alive).

Quote Tweet

grsecurity

@grsecurity

Apr 26, 2019

I love that there have probably been about 1000 emails on this topic on the KSPP list about how they're going to build a better PAX_MEMORY_SANITIZE, and finally after 3 years they've come full circle to how PAX_MEMORY_SANITIZE has always worked: openwall.com/lists/kernel-h

Show this thread

Daniel Micay

@DanielMicay

Replying to

@dvyukov

I haven't looked at the threads, so I don't know the specific context. One of the main benefits of zero-on-free is purging potentially sensitive data quickly. It's also often safer to read zeroed data like NULL pointers leading to reliable faults instead of stale/dangling ones.

1:45 AM · May 10, 2019Twitter Web Client

Replying to

and

If you're willing to pay the performance cost, you can also check that the data is still zeroed on allocation, to detect write-after-free. In this case, zeroing rather than using another byte value has a major performance advantage since pages are often wanted as already zeroed.

Replying to

and

For other cases, like malloc or kmalloc, asking for zeroed data isn't nearly as common, and it's not as expensive to fill with a different value. Zero is the least aggressive since it often gets treated as NULL / empty data. Non-zero tends to uncover more bugs via more crashes.

Show replies

Replying to

Well, yes. But is it pure hypothetical? Is it just all else being equal zeroing early is probably better? Zero-on-malloc prevents very clear class of vulns/bugs -- using/leaking uninit data. Zero-on-free does not seem to prevent _anything_ on top of this. Or not?

Replying to

It's not hypothetical that eliminating sensitive data from memory earlier is helpful. That's not about preventing a class of vulnerabilities but rather reducing the impact of a compromise at a later point. It minimizes the lifetime of sensitive data. It's often done case-by-case.

Show replies