ELF built without PIE & Stack Protection about rootbeer HOT 8 CLOSED

I don't see any reason why not

from rootbeer.

Hi @azbesthu I'm really sorry I didn't see this until just now. I'm not sure what version was used to compile 0.0.7 but I've just built 0.0.8 using version 21 so that should have all the protections mentioned.

I'm going to close this issue as I believe it's solved however please feel free to open more issues if you find issues with the native libraries! Thanks all.

from rootbeer.

@stealthcopter thanks for the merged of the PR.
Is a 0.0.9 release is plan with the rebuild of the .so files ?
Thx

from rootbeer.

up

from rootbeer.

Hey @stealthcopter

Which NDK version was in use while building v0.0.7?
I just asking, because it seems current NDK v19b by default has " -stack-protector 2" in verbose log while building, that seems to be "-fstack-protector-strong" equivalent in LLVM.
I saw an issue in NDK v18 about they accidently removed this flag, but they re-enabled it in v18b.
android/ndk#815
Also do you know which NDK was used for v0.0.6 relese?

Hey @juan-dambra
Is this "-pie" issue happening only on MIPS platform? I just asking, because our security team mentioned it only for mips64 with v0.0.6 release. If I understand correctly, v0.0.7 dropped mips support, because google also dropped it from newer NDK versions. So maybe it is not a problem any more with that.

from rootbeer.

Hello,

I have tested the library with different tools(readelf, decomp) and found the following result: while the 32bit archs are indeed protected against stack smashing (armv7 an x86) however the more common 64 bit archs (arm64 and x86_64) don’t seem to be built the same way, and don’t have the needed checks.

Is there a chance that this can be fixed on your end ?@stealthcopter @scottyab

Thanks a lot!

from rootbeer.

@slawert As this is an area I'm not very familiar with it's going to take me a while to research this. We'd love for someone to make a PR if there is anyone has more of a clue how to change this without removing support for any devices. Thanks :)

from rootbeer.

The PR was merged, but not released, possible to make a release with the fix ?

from rootbeer.