Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory?

A command-line utility like this would be perfect:

shred-memory [options] [{params to the application...}]

share|improve this question
aren't thinks like PIC and stack smashing and stuff supposed to help with apps trying to read an apps memory? – xenoterracide Sep 18 '10 at 18:42

Linux (like any modern multi-process OSes, I would hope) ensures that processes only get zeroed out pages when they allocate memory. So a process cannot read the memory formerly used by another process.

Under Linux, the zeroing out happens when a page is allocated, not when it is freed. This leaves two ways of reading the memory formerly used by a process:

  • exploit a kernel bug
  • dump the contents of the RAM or swap (which requires root or physical access)

A patch to the Linux kernel to allow zeroing out pages as soon as they are freed was proposed (sanitize_mem episode 1, sanitize_mem episode 2), but as far as I can tell not accepted.

In practice, the biggest window for attack is the swap space (which can retain data for a long time), and even that is not trivial for the attacker (who needs to steal the disk, and sort out the jumble of pages). It's also the easiest to fix: encrypt the swap space with dm-crypt.

share|improve this answer

In addition to Gilles answer:

  • You may lock page in-memory to prevent swapping (unless you know what you are doing - like storing password - it is bad idea and it may affect performance of system)
  • You may override free function to sanatize memory by hand using LD_LIBRARY_PRELOAD
share|improve this answer

There are utilities for wiping memory, but it would be after the program in question had exited and freed up its memory. I know of nothing that will specifically wipe the memory allocated by a particular program.

Check out "smem" (among others) from the "secure_delete" suite at thc.org for wiping free memory of a live system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.