Difference between revisions of "Heap Inspection"

From OWASP
Jump to: navigation, search
Line 2: Line 2:
 
{{Template:Fortify}}
 
{{Template:Fortify}}
  
==Abstract==
+
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 +
 
 +
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 +
 
 +
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 +
 
 +
[[ASDR Table of Contents]]
 +
__TOC__
  
Do not use realloc() to resize buffers that store sensitive information.
 
  
 
==Description==
 
==Description==
 +
 +
Do not use realloc() to resize buffers that store sensitive information.
  
 
Heap inspection vulnerabilities occur when sensitive data, such as a password or an encryption key, can be exposed to an attacker because they are not removed from memory.
 
Heap inspection vulnerabilities occur when sensitive data, such as a password or an encryption key, can be exposed to an attacker because they are not removed from memory.
Line 12: Line 20:
 
The realloc() function is commonly used to increase the size of a block of allocated memory. This operation often requires copying the contents of the old memory block into a new and larger block. This operation leaves the contents of the original block intact but inaccessible to the program, preventing the program from being able to scrub sensitive data from memory. If an attacker can later examine the contents of a memory dump, the sensitive data could be exposed.
 
The realloc() function is commonly used to increase the size of a block of allocated memory. This operation often requires copying the contents of the old memory block into a new and larger block. This operation leaves the contents of the original block intact but inaccessible to the program, preventing the program from being able to scrub sensitive data from memory. If an attacker can later examine the contents of a memory dump, the sensitive data could be exposed.
  
==Examples ==
+
 
 +
==Risk Factors==
 +
 
 +
TBD
 +
 
 +
==Examples==
  
 
The following code calls realloc() on a buffer containing sensitive data:
 
The following code calls realloc() on a buffer containing sensitive data:
Line 24: Line 37:
 
There is an attempt to scrub the sensitive data from memory, but realloc() is used, so a copy of the data can still be exposed in the memory originally allocated for cleartext_buffer.
 
There is an attempt to scrub the sensitive data from memory, but realloc() is used, so a copy of the data can still be exposed in the memory originally allocated for cleartext_buffer.
  
==Related Threats==
+
==Related [[Attacks]]==
  
==Related Attacks==
+
* [[Attack 1]]
 +
* [[Attack 2]]
  
==Related Vulnerabilities==
 
  
==Related Countermeasures==
+
==Related [[Vulnerabilities]]==
  
==Categories==
+
* [[Vulnerability 1]]
 +
* [[Vulnerabiltiy 2]]
  
[[Category:Implementation]]
 
  
[[Category:C]]
+
==Related [[Controls]]==
  
[[Category:Sensitive Data Protection Vulnerability]]
+
* [[Control 1]]
 +
* [[Control 2]]
  
[[Category:Code Snippet]]
 
  
[[Category:Use of Dangerous API]]
+
==Related [[Technical Impacts]]==
  
 +
* [[Technical Impact 1]]
 +
* [[Technical Impact 2]]
 +
 +
 +
==References==
 +
TBD
 +
 +
[[Category:FIXME|add links
 +
 +
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 +
 +
Availability Vulnerability
 +
 +
Authorization Vulnerability
 +
 +
Authentication Vulnerability
 +
 +
Concurrency Vulnerability
 +
 +
Configuration Vulnerability
 +
 +
Cryptographic Vulnerability
 +
 +
Encoding Vulnerability
 +
 +
Error Handling Vulnerability
 +
 +
Input Validation Vulnerability
 +
 +
Logging and Auditing Vulnerability
 +
 +
Session Management Vulnerability]]
 +
 +
__NOTOC__
 +
 +
 +
[[Category:OWASP ASDR Project]]
 +
[[Category:Implementation]]
 +
[[Category:C]]
 +
[[Category:Sensitive Data Protection Vulnerability]]
 +
[[Category:Code Snippet]]
 +
[[Category:Use of Dangerous API]]
 
[[Category:API Abuse]]
 
[[Category:API Abuse]]

Revision as of 07:29, 25 September 2008

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


This article includes content generously donated to OWASP by Fortify.JPG.

Last revision (mm/dd/yy): 09/25/2008

Vulnerabilities Table of Contents

ASDR Table of Contents

Contents


Description

Do not use realloc() to resize buffers that store sensitive information.

Heap inspection vulnerabilities occur when sensitive data, such as a password or an encryption key, can be exposed to an attacker because they are not removed from memory.

The realloc() function is commonly used to increase the size of a block of allocated memory. This operation often requires copying the contents of the old memory block into a new and larger block. This operation leaves the contents of the original block intact but inaccessible to the program, preventing the program from being able to scrub sensitive data from memory. If an attacker can later examine the contents of a memory dump, the sensitive data could be exposed.


Risk Factors

TBD

Examples

The following code calls realloc() on a buffer containing sensitive data:

 cleartext_buffer = get_secret();
 ...
 cleartext_buffer = realloc(cleartext_buffer, 1024);
 ...
 scrub_memory(cleartext_buffer, 1024);

There is an attempt to scrub the sensitive data from memory, but realloc() is used, so a copy of the data can still be exposed in the memory originally allocated for cleartext_buffer.

Related Attacks


Related Vulnerabilities


Related Controls


Related Technical Impacts


References

TBD