SQ14139
Detected Windows executable files compiled without following the SDL best practices while using banned memory functions.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | hardening: warning Reason: vulnerability mitigation issues |
About the issue
Security Development Lifecycle (SDL) is a group of enhanced compile-time checks that report common coding mistakes as errors. These checks prevent the use of hard-to-secure memory manipulation functions. They enforce static memory access checks, and allow only the use of range-verified memory access functions. While these checks do not prevent every memory corruption issue by themselves, they do help reduce the likelihood.
How to resolve the issue
- It's highly recommended to enable these checks for all software components used at security boundaries, or those that process user controlled inputs.
- To enable these checks, refer to your programming language toolchain documentation.
- In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Secure Development Lifecycle: The essential guide to safe software pipelines (External resource - TechBeacon)
- Microsoft’s Free Security Tools – banned.h (External resource - Microsoft)
- What is 'Memory Corruption' (External resource - The Economic Times)