CWE-14Compiler Removal of Code to Clear Buffers

Description

Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

[object Object]

Common consequences

• Confidentiality,Access Control→Read Memory,Bypass Protection Mechanism
  This weakness will allow data that has not been cleared from memory to be read. If this data contains sensitive password information, then an attacker can read the password and use the information to bypass protection mechanisms.

Potential mitigations

• Implementation
  Store the sensitive data in a "volatile" memory location if available.
• Build and Compilation
  If possible, configure your compiler so that it does not remove dead stores.
• Architecture and Design
  Where possible, encrypt sensitive data that are used by a software system.

Related CWEs

Recent CVEs classified under this CWE