'Need Assistance with Security assessment on Flutter compiled binaries
I'm developing an android app using flutter but during vulnerability assessment client have raised security concerns on flutter compiled arm-based binaries.
NX - The shared object does not have an NX bit set. NX bit offers protection against exploitation of memory-corruption vulnerabilities by marking the memory page as non- executable. Use option --noexecstack or -z noexecstack to mark the stack as non- executable.
STACK CANARY - This shared object does not have a stack canary value added to the stack. Stack canaries are used to detect and prevent exploits from overwriting return address. Use the option - fstack- protector- all to enable stack canaries.
No RELRO - This shared object does not have RELRO enabled. The entire GOT (.got and .got.plt both) are writable. Without this compiler flag, buffer overflows on a global variable can overwrite GOT entries. Use the option -z,relro,- z,now to enable full RELRO and only -z,relro to enable partial RELRO.
Files: lib/armeabi-v7a/libapp.so (1,2,3), lib/mips/libmodpdfium.so (3), lib/armeabi-v7a/libtool-checker.so (2)
Thanks in advance :)
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|