Memory Reading – Allocating Empty Space on a System

memoryoperating systemsSecurity

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer need, would it be possible to read recently released memory from another applications? Or is this somehow protected by modern operating system?

I have no practical application for this, I'm just curious. I realize there are some issues with allocating "all available memory" in real-life.

Edit: To clarify, I'm asking specifically about "Released" memory, not accessing memory that is currently allocated by another application.

Best Answer

No, because a good kernel wipes the contents of memory before it is issued to a process to protect against exactly the kind of attack you propose.

On Unixy systems, memory is allocated to processes by extending what's called the program break, which is the limit of virtually-addressable space a process can use. A process tells the kernel it wants to extend its addressable space, and the kernel will allow it if memory is available or the call will fail if not. (The name of the brk() system call comes from this concept.)

In practice, large blocks of freed memory don't often butt up against the program break, which is what would be required for a process to return memory to the kernel by shrinking the program break. This is, of course, all dependent on your system's implementation of malloc() and free(). If you have sources available, they'll tell you whether or not memory is ever returned.

There are no security implications for malloc() not initializing memory because anything it got via brk() will have been scrubbed and anything previously free()d will have been written by the same process.

Related Topic