SQ14144
Detected Windows executable files that utilize the outdated and unsafe shared section model for inter process communication.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | high | high | 3 | hardening: fail Reason: critical code linking issues |
About the issue
Windows executable files are mapped in memory as a sequence of allocated pages backed by its physical content. The pages are grouped into sections with defined access rights. For data synchronization purposes, sharing section contents across process boundaries is allowed. Any executable file instance, regardless of its privilege level, has access to the same shared section data during runtime. This makes it possible to access, overwrite, tamper with, or completely bypass security mechanisms.
How to resolve the issue
- Shared data sections are considered unsafe, and their use should be deprecated.
- Update data synchronization to use mapped sections. Mapped sections are named objects (created during runtime) with strictly defined security descriptors. These additional security features enable fine-grained control, and mitigate the shared section access issues.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Why .shared sections are a security hole (External resource - Microsoft)