SQ14110
Detected Windows executable files that negate ASLR by forcing predicable relocation to first granularity base.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | high | low | 3 | hardening: fail Reason: critical code linking issues |
About the issue
Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This mitigation is detected as enabled, but rendered ineffective due to highly predictable memory base assignment. When the memory base address is unspecified by being set to zero, the operating system predictably loads the image on the first memory granularity base. That completely negates the ASLR mitigation.
How to resolve the issue
- Review the programming language linker options.
- In Microsoft VisualStudio, you should check if the linker option /BASE is set to zero, and change the value accordingly.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Base Address (External resource - techopedia)
- Software defense: mitigating common exploitation techniques (External resource - Microsoft)