Difference between revisions of "Heap Inspection"

From OWASP
Jump to: navigation, search
Line 28: Line 28:
  
 
==Related Attacks==
 
==Related Attacks==
 +
 +
[[:Category:API Abuse Attack]]
  
 
==Related Vulnerabilities==
 
==Related Vulnerabilities==
Line 34: Line 36:
  
 
==Categories==
 
==Categories==
 
{{Template:Stub}}
 
  
 
[[Category:Implementation]]
 
[[Category:Implementation]]
Line 44: Line 44:
  
 
[[Category:Code Snippet]]
 
[[Category:Code Snippet]]
 +
 +
[[Category:Use of Dangerous API]]

Revision as of 12:59, 18 July 2006

This article includes content generously donated to OWASP by Fortify.JPG.

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Abstract

Do not use realloc() to resize buffers that store sensitive information.

Description

Heap inspection vulnerabilities occur when sensitive data, such as a password or an encryption key, can be exposed to an attacker because they are not removed from memory.

The realloc() function is commonly used to increase the size of a block of allocated memory. This operation often requires copying the contents of the old memory block into a new and larger block. This operation leaves the contents of the original block intact but inaccessible to the program, preventing the program from being able to scrub sensitive data from memory. If an attacker can later examine the contents of a memory dump, the sensitive data could be exposed.

Examples

The following code calls realloc() on a buffer containing sensitive data:

 cleartext_buffer = get_secret();
 ...
 cleartext_buffer = realloc(cleartext_buffer, 1024);
 ...
 scrub_memory(cleartext_buffer, 1024);

There is an attempt to scrub the sensitive data from memory, but realloc() is used, so a copy of the data can still be exposed in the memory originally allocated for cleartext_buffer.

Related Threats

Related Attacks

Category:API Abuse Attack

Related Vulnerabilities

Related Countermeasures

Categories