Is it necessary to clean up stack contents?

Question

We are under a PCI PA-DSS certification and one of its requirements is to avoid writing clean PAN (card number) to disk. The application is not writing such information to disk, but if the operating system (Windows, in this case) needs to swap, the memory contents is written to page file. Therefore the application must clean up the memory to prevent from RAM capturer services to read sensitive data.

There are three situations to handle:

• heap allocation (malloc): before freeing the memory, the area can be cleaned up with memset
• static or global data: after being used, the area can be cleaned up using memset
• local data (function member): the data is put on stack and is not accessible after the function is finished

For example:

void test()
{
  char card_number[17];

  strcpy(card_number, "4000000000000000");
}

After test executes, the memory still contains the card_number information.

One instruction could zero the variable card_number at the end of test, but this should be for all functions in the program.

memset(card_number, 0, sizeof(card_number));

Is there a way to clean up the stack at some point, like right before the program finishes?

Answer 1

Cleaning the stack right when the program finishes might be too late, it could have already been swapped out during any point at its runtime. You should keep your sentitive data only in memory locked with VirtualLock so it does not get swapped out. This has to happen before said sensitive data is read.

There is a small limit on how much memory you can lock like this so you can propably not lock the whole stack and should avoid storing sensitive data on the stack at all.

Answer 2

I assume you want to get rid of this situation below:

#include <iostream>

using namespace std;

void test()
{
    char card_number[17];
    strcpy(card_number, "1234567890123456");
    cout << "test() -> " << card_number << endl;
}

void test_trash()
{
    // don't initialize, so get the trash from previous call to test()
    char card_number[17];
    cout << "trash from previous function -> " << card_number << endl;
}

int main(int argc, const char * argv[])
{
    test();
    test_trash();
    return 0;
}

Output:

test() -> 1234567890123456
trash from previous function -> 1234567890123456

You CAN do something like this:

#include <iostream>

using namespace std;

class CardNumber
{
    char card_number[17];

public:
    CardNumber(const char * value)
    {
        strncpy(card_number, value, sizeof(card_number));
    }

    virtual ~CardNumber()
    {
        // as suggested by @piedar, memset_s(), so the compiler
        // doesn't optimize it away.
        memset_s(card_number, sizeof(card_number), 0, sizeof(card_number));
    }

    const char * operator()()
    {
        return card_number;
    }
};

void test()
{
    CardNumber cardNumber("1234567890123456");
    cout << "test() -> " << cardNumber() << endl;
}

void test_trash()
{
    // don't initialize, so get the trash from previous call to test()
    char card_number[17];
    cout << "trash from previous function -> " << card_number << endl;
}

int main(int argc, const char * argv[])
{
    test();
    test_trash();
    return 0;
}

Output:

test() -> 1234567890123456
trash from previous function ->

You can do something similar to clean up memory on the heap or static variables. Obviously, we assume the card number will come from a dynamic source instead of the hard-coded thing...

AND YES: to explicit answer the title of your question: The stack will not be cleaned automatically... you have to clean it by yourself.

Answer 3

I believe it is necessary, but this is only half of the problem.

There are two issues here:

1. In principle, nothing prevents the OS from swapping your data while you are still using it. As pointed out in the other answer, you want VirtualLock on windows and mlock on linux.

2. You need to prevent the optimizer from optimizing out the memset. This also applies to global and dynamically allocated memory. I strongly suggest to take a look at cryptopp SecureWipeBuffer.

In general, you should avoid to do it manually, as it is an error-prone procedure. Instead, consider using a custom allocator or a custom class template for secure data that can be freed in the destructor.

Answer 4

The stack is cleaned up by moving the stack pointer, not by actually popping values from it. The only mechanics are to pop the return into the appropriate registers. You must do it all manually. Also -- volatile can help you avoid optimizations on a per variable basis. You can manually pop the stack clean, but -- you need assembler to do that -- and it is not so simple to start manipulating the stack -- it is not actually your resource -- the compiler owns it as far as you are concerned.