Skip to main content

SQ14154

Detected Windows executable files with different data tables overlapping with each other or with file headers.

priorityCI/CD statusseverityeffortRL levelRL assessment
failhighhigh4hardening: fail
Reason: critical code linking issues

About the issue​

Windows executable files consist of various data tables that help the operating system loader provide the information necessary for the application to run. The tables contain references to memory layouts, function symbols the application uses and provides, configurations of security features, and fulfill various other execution needs. Due to their sensitivity, all data tables should be isolated from each other. At no point should one table be allowed to directly modify another. Vulnerability mitigations are implemented with the assumption that the data tables are read-only, or immutable. Allowing data tables and application headers to self-modify may lead to exposing critical security data to overwrites, tampering, and complete bypasses of vulnerability mitigations. This issue is typically reported when a software publisher uses a low quality executable packing solution.

How to resolve the issue​

  • You should deprecate the use of runtime packers, or enforce digital rights management via less intrusive ways that preserve compatibility with vulnerability mitigation options.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.

For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.

The percentages are calculated from the total amount of packages analyzed:

  • RubyGems: 174K
  • Nuget: 189K
  • PyPi: 403K
  • NPM: 2.1M