Skip to main content

SQ14109

Detected Windows executable files that trigger ASLR compatibility mode and reduce its effectiveness.

priorityCI/CD statusseverityeffortRL levelRL assessment
passmediumlowNonehardening: warning
Reason: mitigation effectiveness issues

About the issue​

Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This mitigation is detected as enabled, but rendered ineffective since the set load base address forces the 64-bit image to load within the lower 32-bit memory range. Having a smaller memory range makes ASLR more predictable, and it is therefore easier for malicious code to bypass it.

How to resolve the issue​

  • Review the programming language linker options.
  • In Microsoft VisualStudio, you should check if the linker option /BASE is set to a value lesser than 4GB.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.

For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.

The percentages are calculated from the total amount of packages analyzed:

  • RubyGems: 174K
  • Nuget: 189K
  • PyPi: 403K
  • NPM: 2.1M