FS#43231 - [bzip2] missing RELRO (LDFLAGS not respected)
Attached to Project:
Arch Linux
Opened by Daniel Micay (thestinger) - Friday, 26 December 2014, 06:52 GMT
Last edited by Eli Schwartz (eschwartz) - Wednesday, 12 July 2017, 20:15 GMT
Opened by Daniel Micay (thestinger) - Friday, 26 December 2014, 06:52 GMT
Last edited by Eli Schwartz (eschwartz) - Wednesday, 12 July 2017, 20:15 GMT
|
Details
The bzip2 and bzip2recover executables are built without
RELRO. This can be solved either by modifying the build
system or by adding makedepends=(hardening-wrapper). This
can be confirmed with `checksec --file`. Note that these are
often run on untrusted input.
The missing canary on bzip2recover is a false positive - it is built with -fstack-protector-strong but there are no candidates for SSP protection. |
This task depends upon
Closed by Eli Schwartz (eschwartz)
Wednesday, 12 July 2017, 20:15 GMT
Reason for closing: Fixed
Additional comments about closing: Fixed in binutils
Wednesday, 12 July 2017, 20:15 GMT
Reason for closing: Fixed
Additional comments about closing: Fixed in binutils