Linux (like any modern multi-process OSes, I would hope) ensures that processes only get zeroed out pages when they allocate memory. So a process cannot read the memory formerly used by another process.
Under Linux, the zeroing out happens when a page is allocated, not when it is freed. This leaves two ways of reading the memory formerly used by a process:
- exploit a kernel bug
- dump the contents of the RAM or swap (which requires root or physical access)
A patch to the Linux kernel to allow zeroing out pages as soon as they are freed was proposed (sanitize_mem
episode 1, sanitize_mem
episode 2), but as far as I can tell not accepted.
In practice, the biggest window for attack is the swap space (which can retain data for a long time), and even that is not trivial for the attacker (who needs to steal the disk, and sort out the jumble of pages). It's also the easiest to fix: encrypt the swap space with dm-crypt
.