SQ14115

Detected Windows executable files that try to implement buffer overrun vulnerability mitigation without the appropriate security cookie.

priority	CI/CD status	severity	effort	RL level	RL assessment
	pass	high	medium	None	hardening: warning Reason: ineffective mitigations found

About the issue

Buffer overrun protection (Stack Guard) is a vulnerability mitigation option that prevents stack-based memory corruptions. Special values, called stack cookies, are inserted in the stack immediately before the return address value. Code flow protection is achieved by monitoring for unexpected stack cookie value changes. The application does try to implement buffer overrun protection, but the stack cookie it depends on is absent from the headers.

How to resolve the issue

• Review the programming language linker options, or consider using a different executable packing solution.

• In Microsoft VisualStudio, you can enable buffer overrun protection mitigation by setting the linker option /GS to ON.

Incidence statistics

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.

For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.

The percentages are calculated from the total amount of packages analyzed:

• RubyGems: 174K
• Nuget: 189K
• PyPi: 403K
• NPM: 2.1M

Recommended reading

• Security Technologies: Stack Smashing Protection (StackGuard) (External resource - Red Hat)
• Stack Canaries – Gingerly Sidestepping the Cage (External resource - SANS)