SQ18102
Detected Linux executable files that declare some writable segments as executable, making non-executable memory mitigations less effective.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | high | medium | None | hardening: warning Reason: ineffective mitigations found |
About the issue
The GNU linker allows overriding its default behavior with linker scripts. This is often done in builds where the developer needs a greater amount of control over the linking process. Upon linking, default segment flags are set based on the sections. However, in linker scripts, this can be overridden via the FLAGS parameter, which allows the user to manually specify the flags for each segment. This is prevalent in automatically generated or misconfigured linker scripts. Explicitly marking the segments as both writable and executable will cause protection mitigations to become less effective, and possibly increase the chance of arbitrary code execution attacks.
How to resolve the issue
- On some architectures, a read permission on a segment implies the segment is executable as well, so you should avoid declaring segments as both readable and writable.
- Disallow execution on writable memory segments.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- From Zero to main(): Demystifying Firmware Linker Scripts (External resource - Interrupt)
- Data Execution Prevention (External resource - Microsoft)