Skip to content
OpenAdvisories

Weakness (CWE)

CWE-14: Compiler Removal of Code to Clear Buffers

Variant Draft

Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

How to prevent it (3 mitigations)

  1. Implementation

    Store the sensitive data in a "volatile" memory location if available.

  2. Build and Compilation

    If possible, configure the compiler so that it does not remove dead stores.

  3. Architecture and Design

    Where possible, encrypt sensitive data that are used by a software system.

Source: MITRE CWE-14

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.1
    CVE-2023-32097

    Key duplication in GSDK

    Compiler removal of buffer clearing in sli_crypto_transparent_aead_decrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.

    silabs.com Gecko Platform
  • Low 3.1
    CVE-2023-32096

    Key duplication in GSDK

    Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.

    silabs.com Gecko Platform
  • Low 3.1
    CVE-2023-0965

    Key duplication in GSDK

    Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.

    silabs.com Gecko Platform