Skip to content

Detect the use of FORTIFY_SOURCE #94

@prabhu

Description

@prabhu

https://www.redhat.com/en/blog/enhance-application-security-fortifysource

We need to collect the various _chk functions from libc. This can be done with blint or commands such as readelf. The data can be stored under annotations.

readelf -s /usr/lib64/libc.so.6| grep "_chk"
1457: 0000000000121e6e    25 FUNC    GLOBAL DEFAULT   17 __recv_chk@@GLIBC_2.4
  2095: 0000000000121b7e    22 FUNC    GLOBAL DEFAULT   17 __read_chk@@GLIBC_2.4
  1058: 0000000000029c7e    82 FUNC    LOCAL  DEFAULT   17 __fgets_chk.cold
  1059: 0000000000029cd0    82 FUNC    LOCAL  DEFAULT   17 __fgetws_chk.cold
  1060: 0000000000029d22    84 FUNC    LOCAL  DEFAULT   17 __fread_chk.cold
  1061: 0000000000029d76    84 FUNC    LOCAL  DEFAULT   17 __gets_chk.cold
  1064: 000000000012145e   275 FUNC    LOCAL  DEFAULT   17 __memcpy_chk_ifunc
  1065: 000000000012158e   275 FUNC    LOCAL  DEFAULT   17 __memmove_chk_ifunc
  1066: 00000000001216be   275 FUNC    LOCAL  DEFAULT   17 __mempcpy_chk_ifunc
  1067: 00000000001217ee   239 FUNC    LOCAL  DEFAULT   17 __memset_chk_ifunc
  1068: 0000000000122c4e   104 FUNC    LOCAL  DEFAULT   17 __wmemset_chk_ifunc
  1752: 000000000018594e    15 FUNC    LOCAL  DEFAULT   17 __mempcpy_chk_av[...]
  1855: 000000000016c64e    15 FUNC    LOCAL  DEFAULT   17 __memmove_chk_av[...]
  1936: 000000000016d0ce    15 FUNC    LOCAL  DEFAULT   17 __wmemset_chk_av[...]
  1944: 000000000017cc8e    15 FUNC    LOCAL  DEFAULT   17 __memmove_chk_ev[...]
  1995: 000000000018598e    15 FUNC    LOCAL  DEFAULT   17 __memcpy_chk_avx[...]
  2061: 000000000018598e    15 FUNC    LOCAL  DEFAULT   17 __memmove_chk_av[...]
  2073: 000000000018624e    15 FUNC    LOCAL  DEFAULT   17 __wmemset_chk_av[...]
  2076: 000000000017cd3e    15 FUNC    LOCAL  DEFAULT   17 __memcpy_chk_eve[...]

At level 3, even the memory management functions from the list below would use their _chk equivalents.

memmove(),  memcpy(), snprintf(), vsnprintf(), strtok() and strncat()

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions