SQ14134
Detected Windows executable files that implement now deprecated RFG vulnerability mitigation protection.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
| None | pass | low | medium | None | None |
About the issue
Return Flow Guard (RFG) protects the code flow integrity by ensuring that functions return only to their respective callers. This was an experimental vulnerability mitigation protection that was deprecated due to efficacy concerns. Since the mitigation was a in-software implementation of a more advanced hardware-level protection (designed by Intel), the feature was completely removed from tooling support. Applications that still contain instrumentation for return flow protection continue to work correctly, without significant performance impact, on all operating system versions.
How to resolve the issue
- Re-compile the application with a newer version of the programming language toolchain. This will remove the deprecated functionality from the resulting executable, and allow for its replacement with a more secure Intel CET vulnerability mitigation protection.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Return Flow Guard (External resource - Tencent)
- Control-flow integrity (External resource - MaskRay)
- Hardware-Level Security: Encryption and Authentication (External resource - EFINIX)