Monero GUI not linked with /DYNAMICBASE or hardening on windows, no ASLR
M
Monero
Submitted None
Actions:
Reported by
flxflndy_
Vulnerability Details
Technical details and impact analysis
**Summary:**
The monero daemon is compiled and linked without ASLR, at least on windows. This security hardening feature should be enabled in order to make exploiting of this service harder.
**Description:**
See above.
## Releases Affected:
* At least v0.11.1.0 (probably more) / Tested on Windows 8.1
## Steps To Reproduce:
1. Start the monero-gui and monero daemon on windows
2. Start Process Explorer https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
3. Check ASLR under "select columns"
4. See that ASLR is not activated for this process.
## Supporting Material/References:
* I've attached a screenshot of the sysinternals tool on my machine.
## Impact
Exploiting code reuse attacks is alot easier without this feature.
This might impact future bug bounty payouts because people can't exploit reliable bugs to get code execution :)
Report Details
Additional information and metadata
State
Closed
Substate
Resolved