Core Dumps


All OS platforms have a "core dump" functionality which poses potential security and privacy risks. According to Wikipedia: [1]

In computing, a core dump (in Unix parlance), memory dump, or system dump consists of the recorded state of the working memory of a computer program at a specific time, generally when the program has crashed or otherwise terminated abnormally. In practice, other key pieces of program state are usually dumped at the same time, including the processor registers, which may include the program counter and stack pointer, memory management information, and other processor and operating system flags and information. Core dumps are often used to assist in diagnosing and debugging errors in computer programs.

The primary function of core dumps is to provide the user or programmer with specialized information to determine the root cause of a system crash, in order to perform debugging. These files are viewable as text or image formats, and can be analyzed with special tools. In Windows, both kernel-mode dumps and user-mode dumps are available. The former contains information on either the full memory or large sections of it, while the latter is limited to single processes. [1]

Security and Privacy Risks[edit]

Core dumps can potentially contain sensitive information like: [3] [2] [4]

  • Any activities undertaken in a session.
  • All existing contents in RAM at the time of a crash:
    • Disk encryption keys and passwords.
    • Details of open documents.
    • Other passwords.
    • Detailed system information that can assist targeted attacks.

Clearly, how long copies of data survive and where they end up are critical factors. There is no guarantee that RAM is wiped or overwritten during this process. This is not just a theoretical concern, as exploits in the wild have been observed which force privileged applications to perform core dumps, disclosing the contents of shadow password files and other information in the process. [2]

While this information is stored locally on GNU/Linux distributions, this is not the case on proprietary platforms. Windows and macOS generally ship this memory information to the OS vendor. [2] [5] [6] [7] [8]

For greater security, advanced users should consider configuring the OS to disable core dumps. If possible, preventing access to process memory is also advisable, along with secure storage of the file system. [9] [10] GNU/Linux users can further research the disabling of core dump features here and here.



Whonix Core Dumps wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Core Dumps wiki page Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

Random News:

Join us in testing our new AppArmor profiles for improved security! (forum discussion)

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)