1 .\" Copyright (C) 2017 Michael Kerrisk <mtk.manpages@gmail.com>
3 .\" %%%LICENSE_START(VERBATIM)
4 .\" Permission is granted to make and distribute verbatim copies of this
5 .\" manual provided the copyright notice and this permission notice are
6 .\" preserved on all copies.
8 .\" Permission is granted to copy and distribute modified versions of this
9 .\" manual under the conditions for verbatim copying, provided that the
10 .\" entire resulting derived work is distributed under the terms of a
11 .\" permission notice identical to this one.
13 .\" Since the Linux kernel and libraries are constantly changing, this
14 .\" manual page may be incorrect or out-of-date. The author(s) assume no
15 .\" responsibility for errors or omissions, or for damages resulting from
16 .\" the use of the information contained herein. The author(s) may not
17 .\" have taken the same level of care in the production of this manual,
18 .\" which is licensed free of charge, as they might when working
21 .\" Formatted or processed versions of this manual, if unaccompanied by
22 .\" the source, must acknowledge the copyright and authors of this work.
25 .TH BZERO 3 2017-03-13 "Linux" "Linux Programmer's Manual"
27 bzero, explicit_bzero \- zero a byte string
30 .B #include <strings.h>
32 .BI "void bzero(void *" s ", size_t " n );
34 .BI "void explicit_bzero(void *" s ", size_t " n );
39 function erases the data in the
41 bytes of the memory starting at the location pointed to by
43 by writing zeroes (bytes containing \(aq\\0\(aq) to that area.
47 function performs the same task as
51 in that it guarantees that compiler optimizations will not remove the
52 erase operation if the compiler deduces that the operation is "unnecessary".
57 first appeared in glibc 2.25.
59 For an explanation of the terms used in this section, see
65 Interface Attribute Value
70 T} Thread safety MT-Safe
75 function is deprecated (marked as LEGACY in POSIX.1-2001); use
78 POSIX.1-2008 removes the specification of
82 function first appeared in 4.3BSD.
86 function is a nonstandard extension that is also present on some of the BSDs.
87 Some other implementations have a similar function, such as
88 .BR memset_explicit ()
94 function addresses a problem that security-conscious applications
95 may run into when using
97 if the compiler can deduce that the location to zeroed will
98 never again be touched by a
100 program, then it may remove the
103 This is a problem if the intent of the
105 call was to erase sensitive data (e.g., passwords)
106 to prevent the possibility that the data was leaked
107 by an incorrect or compromised program.
109 .BR explicit_bzero ()
110 are never optimized away by the compiler.
113 .BR explicit_bzero ()
114 function does not solve all problems associated with erasing sensitive data:
117 .BR explicit_bzero ()
120 guarantee that sensitive data is completely erased from memory.
123 For example, there may be copies of the sensitive data in
124 a register and in "scratch" stack areas.
126 .BR explicit_bzero ()
127 function is not aware of these copies, and can't erase them.
129 In some circumstances,
130 .BR explicit_bzero ()
134 If the compiler determined that the variable containing the
135 sensitive data could be optimized to be stored in a register
136 (because it is small enough to fit in a register,
137 and no operation other than the
138 .BR explicit_bzero ()
139 call would need to take the address of the variable), then the
140 .BR explicit_bzero ()
141 call will force the data to be copied from the register
142 to a location in RAM that is then immediately erased
143 (while the copy in the register remains unaffected).
144 The problem here is that data in RAM is more likely to be exposed
145 by a bug than data in a register, and thus the
146 .BR explicit_bzero ()
147 call creates a brief time window where the sensitive data is more
148 vulnerable than it would otherwise have been
149 if no attempt had been made to erase the data.
151 Note that declaring the sensitive variable with the
155 eliminate the above problems.
156 Indeed, it will make them worse, since, for example,
157 it may force a variable that would otherwise have been optimized
158 into a register to instead be maintained in (more vulnerable)
159 RAM for its entire lifetime.
161 Notwithstanding the above details, for security-conscious applications, using
162 .BR explicit_bzero ()
163 is generally preferable to not using it.
165 .BR explicit_bzero ()
166 anticipate that future compilers will recognize calls to
167 .BR explicit_bzero ()
168 and take steps to ensure that all copies of the sensitive data are erased,
169 including copies in registers or in "scratch" stack areas.