Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory?

A command-line utility like this would be perfect:

shred-memory [options] [{params to the application...}]

  • aren't thinks like PIC and stack smashing and stuff supposed to help with apps trying to read an apps memory? Sep 18, 2010 at 18:42

3 Answers 3


Linux (like any modern multi-process OSes, I would hope) ensures that processes only get zeroed out pages when they allocate memory. So a process cannot read the memory formerly used by another process.

Under Linux, the zeroing out happens when a page is allocated, not when it is freed. This leaves two ways of reading the memory formerly used by a process:

  • exploit a kernel bug
  • dump the contents of the RAM or swap (which requires root or physical access)

A patch to the Linux kernel to allow zeroing out pages as soon as they are freed was proposed (sanitize_mem episode 1, sanitize_mem episode 2), but as far as I can tell not accepted.

In practice, the biggest window for attack is the swap space (which can retain data for a long time), and even that is not trivial for the attacker (who needs to steal the disk, and sort out the jumble of pages). It's also the easiest to fix: encrypt the swap space with dm-crypt.


In addition to Gilles answer:

  • You may lock page in-memory to prevent swapping (unless you know what you are doing - like storing password - it is bad idea and it may affect performance of system)
  • You may override free function to sanatize memory by hand using LD_LIBRARY_PRELOAD

There are utilities for wiping memory, but it would be after the program in question had exited and freed up its memory. I know of nothing that will specifically wipe the memory allocated by a particular program.

Check out "smem" (among others) from the "secure_delete" suite at thc.org for wiping free memory of a live system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy