SW section is present
ID PE012 Level WARNING Category Security
Description
A SW (shared writable) section is present in the executable. A section which is writable and shared at the same time will share writable memory area across processes. This may permit a low privileged process access memory of a high privileged one, which may lead to privilege escalation attacks.
Mitigation
- Make sure you are not merging sections with different memory access attributes.
- Do not explicitly change memory attributes. If doing so, do not mark any sections writable and shared at the same time.
- If you do need to share writable memory across process boundaries, use other safer mechanisms for that, for example: the
CreateFileMappingAPI with proper security attributes; COM; pipes. Alternatively, consider using higher-level libraries which can handle memory access permissions, such as Boost.Interprocess.
If using Visual C++:
- Look for the
/SECTIONoption in the linker command line or the corresponding#pragma sectiondeclarations in the code.
Arguments
This rule has the following output arguments:
-
section_name- Affected section name
Loading...
Unable to load this documentation page.