Linux Desktop application "sifnoded" executable does not use Pie / no ASLR
S
Sifchain
Submitted None
Actions:
Reported by
dantt
Vulnerability Details
Technical details and impact analysis
Hello Sifchain,
sifnoded binary from the Linux application is no position independent executable
PoC;
**$file sifnoded
Output will be like ;
███████
Position independent executables are required for full ASLR support on Linux. Non-pie-binaries are loaded to a fixed location, thus allowing ROP attacks.
Reference for this report; #415272
Thanks.
## Impact
A simple memory corruption bug like a buffer overflow can easily lead to a remote code execution bug. With ASLR these bugs are much harder and sometimes impossible to exploit.
LSB executable should be "LSB shared object" or "LSB pie executable"
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Violation of Secure Design Principles