Closed LongTengDao closed 1 year ago
the memory that the buffer allocator gets can be both:
it does not matter whether you (the process) get your own pages or external pages. what matters is whether it has stale data .
if all the processes make sure to erase sensitive data before they free their memory, the problem do not arise. if not, irrespective of where the memory comes from (your own process versus other process), it can bring an undesired scenario.
in this context, the sensitive data is not a process-scopped entity. by zero-filling the allocations, we are making sure that we are using a clean page and following a best practice in this area.
hope this helps!
Thank you!
Details
If 1, I think need to use
--zero-fill-buffers
for sandbox process; if 2, without unnecessary use of--zero-fill-buffers
, there will be better performance.So which is it? And I'm I right that if 1,
--zero-fill-buffers
is unnecessary for security? Or it will still leak some information I can't imagine?Node.js version
Any, at least for the future.
Example code
No response
Operating system
any
Scope
runtime
Module and version
No response