CWE-591 covers software that keeps sensitive data in memory that is not locked, or is locked incorrectly. The virtual memory manager may then write that memory to a swap file on disk, where it becomes more accessible to outside parties.
Think encryption keys, session secrets, and passwords held by long-running services and desktop applications.
How it happens
The developer knows secrets should not touch disk, reaches for a lock call, and assumes the job is done. MITRE's description explains why that is shaky.
- On Windows,
VirtualLockcan lock a page so it stays in memory. On very old Windows releases (95, 98, Me) it is only a stub and gives no protection. - On POSIX systems,
mlock()keeps a page resident but does not guarantee it will not appear in swap. Some platforms, Linux in particular, do make that guarantee, but it is non-standard and not portable. mlock()calls also require supervisor privilege.- Both calls can fail, and if the return value is ignored the code carries on unprotected.
What an attacker gains
The consequence in the record is confidentiality: sensitive data that is written to a swap file may be exposed. Someone with access to the disk or a disk image can read secrets long after the process exited.
The observed example is CVE-2024-38106, listed as an OS kernel storing sensitive data in improperly locked memory, which let local users gain privileges by winning a race condition.
How to find it
Review the places your code handles keys, tokens, and passwords, and check whether each buffer is locked and whether the lock result is verified. Search for lock calls whose return value is discarded.
How to fix it
MITRE gives two steps.
- At design time, identify the data that needs protection from swapping and choose platform-appropriate protection mechanisms.
- At implementation time, check return values to be sure the locking operations were successful.
If the lock fails, decide deliberately: refuse to load the secret, or run in a documented degraded mode. Do not continue silently.
Quick check
Does mlock() guarantee data never reaches swap?
Not on POSIX in general. It keeps a page resident, but some platforms, notably Linux, add a non-portable guarantee about swapping.
