Compiler Removal of Code to Clear Buffers
CWE-14
Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka dead store removal.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
How this weakness is prevented
- Implementation: Store the sensitive data in a volatile memory location if available.
- Build and Compilation: If possible, configure the compiler so that it does not remove dead stores.
- Architecture and Design: Where possible, encrypt sensitive data that are used by a software system.
Latest Compiler Removal of Code to Clear Buffers vulnerabilities
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_driver_mac_compute in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_sign_message in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_crypto_transparent_aead_decrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_driver_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.