CWE-14 (编译器移除释放缓冲区的代码) — Vulnerability Class 9

CWE-14 represents a critical compiler optimization error where sensitive memory buffers, intended for secure erasure, remain uncleared due to dead store removal. Developers typically attempt to mitigate data leakage by explicitly overwriting secret data, such as cryptographic keys or passwords, with zeros or random values before freeing the memory. However, optimizing compilers may identify these writes as unnecessary if the memory is not subsequently read, effectively removing the scrubbing code to improve performance. This oversight allows attackers to recover sensitive information from memory dumps or core files, leading to severe confidentiality breaches. To prevent this, developers must employ compiler-specific directives, such as volatile qualifiers or intrinsic functions, to force the compiler to retain the clearing operations, ensuring that sensitive data is truly erased from memory before it becomes accessible to malicious actors.