SQ14117
Detected Windows executable files that might not cover the entire application with buffer overrun vulnerability mitigation.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | low | low | None | hardening: warning Reason: ineffective mitigations found |
About the issue
Buffer overrun protection (Stack Guard) is a vulnerability mitigation option that prevents stack-based memory corruptions. This mitigation is detected as enabled, but the application reports zero surface coverage in its internal data structures. Based on the self-reported data, it is probable that the vulnerability mitigation option has not been enabled. Modern applications usually have some functions that need to be protected against buffer overflows. Therefore, it is likely that protection coverage gaps exist.
How to resolve the issue
- In Microsoft VisualStudio, you can enable buffer overrun protection mitigation by setting the linker option /GS to ON.
- If the issue persists, you should review the linker options in any static libraries that the application links with.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Security Technologies: Stack Smashing Protection (StackGuard) (External resource - Red Hat)
- Buffer Overflow Attack (External resource - Imperva)