'Need Assistance with Security assessment on Flutter compiled binaries

I'm developing an android app using flutter but during vulnerability assessment client have raised security concerns on flutter compiled arm-based binaries.

  1. NX - The shared object does not have an NX bit set. NX bit offers protection against exploitation of memory-corruption vulnerabilities by marking the memory page as non- executable. Use option --noexecstack or -z noexecstack to mark the stack as non- executable.

  2. STACK CANARY - This shared object does not have a stack canary value added to the stack. Stack canaries are used to detect and prevent exploits from overwriting return address. Use the option - fstack- protector- all to enable stack canaries.

  3. No RELRO - This shared object does not have RELRO enabled. The entire GOT (.got and .got.plt both) are writable. Without this compiler flag, buffer overflows on a global variable can overwrite GOT entries. Use the option -z,relro,- z,now to enable full RELRO and only -z,relro to enable partial RELRO.

Files: lib/armeabi-v7a/libapp.so (1,2,3), lib/mips/libmodpdfium.so (3), lib/armeabi-v7a/libtool-checker.so (2)

Thanks in advance :)



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source