1 .\" Copyright (C) 2017 Michael Kerrisk <mtk.manpages@gmail.com>
3 .\" %%%LICENSE_START(VERBATIM)
4 .\" Permission is granted to make and distribute verbatim copies of this
5 .\" manual provided the copyright notice and this permission notice are
6 .\" preserved on all copies.
8 .\" Permission is granted to copy and distribute modified versions of this
9 .\" manual under the conditions for verbatim copying, provided that the
10 .\" entire resulting derived work is distributed under the terms of a
11 .\" permission notice identical to this one.
13 .\" Since the Linux kernel and libraries are constantly changing, this
14 .\" manual page may be incorrect or out-of-date. The author(s) assume no
15 .\" responsibility for errors or omissions, or for damages resulting from
16 .\" the use of the information contained herein. The author(s) may not
17 .\" have taken the same level of care in the production of this manual,
18 .\" which is licensed free of charge, as they might when working
21 .\" Formatted or processed versions of this manual, if unaccompanied by
22 .\" the source, must acknowledge the copyright and authors of this work.
25 .TH BZERO 3 2017-09-15 "Linux" "Linux Programmer's Manual"
27 bzero, explicit_bzero \- zero a byte string
30 .B #include <strings.h>
32 .BI "void bzero(void *" s ", size_t " n );
34 .B #include <string.h>
36 .BI "void explicit_bzero(void *" s ", size_t " n );
41 function erases the data in the
43 bytes of the memory starting at the location pointed to by
45 by writing zeros (bytes containing \(aq\\0\(aq) to that area.
49 function performs the same task as
53 in that it guarantees that compiler optimizations will not remove the
54 erase operation if the compiler deduces that the operation is "unnecessary".
59 first appeared in glibc 2.25.
61 For an explanation of the terms used in this section, see
67 Interface Attribute Value
72 T} Thread safety MT-Safe
77 function is deprecated (marked as LEGACY in POSIX.1-2001); use
80 POSIX.1-2008 removes the specification of
84 function first appeared in 4.3BSD.
88 function is a nonstandard extension that is also present on some of the BSDs.
89 Some other implementations have a similar function, such as
90 .BR memset_explicit ()
96 function addresses a problem that security-conscious applications
97 may run into when using
99 if the compiler can deduce that the location to zeroed will
100 never again be touched by a
102 program, then it may remove the
105 This is a problem if the intent of the
107 call was to erase sensitive data (e.g., passwords)
108 to prevent the possibility that the data was leaked
109 by an incorrect or compromised program.
111 .BR explicit_bzero ()
112 are never optimized away by the compiler.
115 .BR explicit_bzero ()
116 function does not solve all problems associated with erasing sensitive data:
119 .BR explicit_bzero ()
122 guarantee that sensitive data is completely erased from memory.
125 For example, there may be copies of the sensitive data in
126 a register and in "scratch" stack areas.
128 .BR explicit_bzero ()
129 function is not aware of these copies, and can't erase them.
131 In some circumstances,
132 .BR explicit_bzero ()
136 If the compiler determined that the variable containing the
137 sensitive data could be optimized to be stored in a register
138 (because it is small enough to fit in a register,
139 and no operation other than the
140 .BR explicit_bzero ()
141 call would need to take the address of the variable), then the
142 .BR explicit_bzero ()
143 call will force the data to be copied from the register
144 to a location in RAM that is then immediately erased
145 (while the copy in the register remains unaffected).
146 The problem here is that data in RAM is more likely to be exposed
147 by a bug than data in a register, and thus the
148 .BR explicit_bzero ()
149 call creates a brief time window where the sensitive data is more
150 vulnerable than it would otherwise have been
151 if no attempt had been made to erase the data.
153 Note that declaring the sensitive variable with the
157 eliminate the above problems.
158 Indeed, it will make them worse, since, for example,
159 it may force a variable that would otherwise have been optimized
160 into a register to instead be maintained in (more vulnerable)
161 RAM for its entire lifetime.
163 Notwithstanding the above details, for security-conscious applications, using
164 .BR explicit_bzero ()
165 is generally preferable to not using it.
167 .BR explicit_bzero ()
168 anticipate that future compilers will recognize calls to
169 .BR explicit_bzero ()
170 and take steps to ensure that all copies of the sensitive data are erased,
171 including copies in registers or in "scratch" stack areas.