Kernel Memory Initialization Enforcement (init_on_alloc / INIT_STACK_ALL_ZERO)
Description
Enforce automatic zero-initialization of kernel stack variables and heap allocations via CONFIG_INIT_STACK_ALL_ZERO and CONFIG_INIT_ON_ALLOC_DEFAULT_ON. These kernel build options ensure that uninitialized memory contains zeros rather than stale data, preventing information disclosure from uninitialized reads and blocking exploitation of uninitialized pointer dereferences. CONFIG_INIT_ON_FREE_DEFAULT_ON zeros memory on deallocation, further reducing the window for use-after-free exploitation by ensuring freed memory does not contain exploitable pointers or data. The runtime equivalent init_on_alloc=1 and init_on_free=1 kernel boot parameters provide the same behavior without requiring a kernel rebuild. Performance overhead is typically 1-3% for init_on_alloc and 1-5% for init_on_free depending on allocation-heavy workloads.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Exploit must work with zero-initialized memory rather than attacker-favorable stale values; finding useful uninitialized data paths becomes significantly harder because stack variables, heap allocations, and freed memory all contain zeros instead of exploitable pointers or data |
| Confidentiality (C) | H → L | Information disclosure via uninitialized memory reads returns zeros instead of kernel pointers, stack data, or heap contents that would enable KASLR bypass or credential theft |
CWE Relationships
Verification
Verify kernel is built with memory initialization options or booted with init_on_alloc/init_on_free parameters
# Expected: 2
# Expected: CONFIG_INIT_ON_FREE_DEFAULT_ON=y
# Expected: init_on_alloc=1