Weakness (CWE)

CWE-591: Sensitive Data Storage in Improperly Locked Memory

Variant Draft

The product stores sensitive data in memory that is not locked, or that has been incorrectly locked.

How to prevent it (2 mitigations)

Architecture and Design

Identify data that needs to be protected from swapping and choose platform-appropriate protection mechanisms.
Implementation

When using potentially risky functions such as mlock() or VirtualLock(), check return values to ensure that locking operations are successful.

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability