Randomise or shred memory of an application

Question

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory?

A command-line utility like this would be perfect:

shred-memory [options] [{params to the application...}]

Answer 1

Linux (like any modern multi-process OSes, I would hope) ensures that processes only get zeroed out pages when they allocate memory. So a process cannot read the memory formerly used by another process.

Under Linux, the zeroing out happens when a page is allocated, not when it is freed. This leaves two ways of reading the memory formerly used by a process:

• exploit a kernel bug
• dump the contents of the RAM or swap (which requires root or physical access)

A patch to the Linux kernel to allow zeroing out pages as soon as they are freed was proposed (sanitize_mem episode 1, sanitize_mem episode 2), but as far as I can tell not accepted.

In practice, the biggest window for attack is the swap space (which can retain data for a long time), and even that is not trivial for the attacker (who needs to steal the disk, and sort out the jumble of pages). It's also the easiest to fix: encrypt the swap space with dm-crypt.

Answer 2

In addition to Gilles answer:

• You may lock page in-memory to prevent swapping (unless you know what you are doing - like storing password - it is bad idea and it may affect performance of system)
• You may override free function to sanatize memory by hand using LD_LIBRARY_PRELOAD

Answer 3

There are utilities for wiping memory, but it would be after the program in question had exited and freed up its memory. I know of nothing that will specifically wipe the memory allocated by a particular program.

Check out "smem" (among others) from the "secure_delete" suite at thc.org for wiping free memory of a live system.