News for hackers. Stuff that matters.

A comment on Stranger Strings: An exploitable flaw in SQLite. Parent comment

Re:Stranger Strings: An exploitable flaw in SQLite by chasil on Tuesday October 25, 2022 @10:20AM (#33330795)
It sounds from the article that "-fstack-protector-all" might remove everything except the denial of service.

"...arbitrary code execution is confirmed when the library is compiled without stack canaries, but unconfirmed when stack canaries are present, and denial-of-service is confirmed in all cases."

Everything should be compiled with all available compiler defenses:

https://manpages.debian.org/testing/devscripts/hardening-che...

[ Parent | on HN ]
Re:Stranger Strings: An exploitable flaw in SQLite by chasil on Tuesday October 25, 2022 @02:41PM (#33334556)
It does appear safe with the OS package on CentOS 7.

  $ hardening-check /usr/lib64/libsqlite3.so.0.8.6
  /usr/lib64/libsqlite3.so.0.8.6:
   Position Independent Executable: no, regular shared library (ignored)
   Stack protected: yes
   Fortify Source functions: yes (some protected functions found)
   Read-only relocations: yes
   Immediate binding: no, not found!
[ Parent | on HN ]