Skip to content

ELF binaries do not enforce secure binary properties

ELF binaries do not enforce secure binary properties

Description

Compilers, Operating Systems and Processors provide a set of techniques to protect and mitigate the risk of memory corruption vulnerabilities like Buffer Overflow or memory exploitation techniques like ROP (Return-Oriented-Programming).

Native code can easily benefit from protections like:

  • RELRO: RELRO is a memory protection technique to harden against memory corruption exploitation techniques. RELRO prevents GOT overwrite attacks.
  • ASLR: ASLR is a memory protection technique to harden against memory corruption exploitation technique. ASLR randomizes the address space of binary to prevent controlled address jumps.
  • No eXecute: Mark memory region as non-executable to harden against memory corruption exploitation technique.
  • Stack canary: Add a canary to memory that gets overwritten in the case of a memory corruption. The canary is checked at runtime to prevent the exploitation of the memory corruption vulnerability.

Recommendation

If Stack canary is missing, Compilers such as GCC enable this feature if requested through compiler options:

  • -fstack-protector: Check for stack smashing in functions with vulnerable objects. This includes functions with buffers larger than 8 bytes or calls to alloca.
  • -fstack-protector-strong: Like -fstack-protector, but also includes functions with local arrays or references to local frame addresses.
  • -fstack-protector-all: Check for stack smashing in every function.

Standards

  • OWASP_MASVS_L1:
    • MSTG_CODE_9
  • OWASP_MASVS_L2:
    • MSTG_CODE_9
  • PCI_STANDARDS:
    • REQ_2_2