SQ14114
Detected Windows executable files that do not implement the buffer overrun vulnerability mitigation protection.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | high | medium | None | hardening: warning Reason: baseline mitigations missing |
About the issue
Buffer overrun protection (Stack Guard) is a vulnerability mitigation option that prevents stack-based memory corruptions. Special values, called stack cookies, are inserted in the stack immediately before the return address value. Code flow protection is achieved by monitoring for unexpected stack cookie value changes. When a function is suspected to return to an address other than the calling one, the vulnerability mitigation triggers and terminates the application execution. This is a runtime mitigation option that selectively protects functions deemed to be at risk from memory corruption attacks by the programming language toolchain.
How to resolve the issue
- In Microsoft VisualStudio, you can enable buffer overrun protection mitigation by setting the linker option /GS to ON.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Security Technologies: Stack Smashing Protection (StackGuard) (External resource - Red Hat)
- Stack Canaries – Gingerly Sidestepping the Cage (External resource - SANS)
- What is 'Memory Corruption' (External resource - The Economic Times)