Executable TLS directory

ID PE105 Level ERROR Category Security

Description

The executable has a TLS (thread local storage) directory which is placed to the executable section. This can make it easier for an attacker to exploit memory corruption vulnerabilities.

This directory should be placed to read-only memory.

Mitigation

  • Make sure you are not merging sections with different memory access attributes.
  • Do not explicitly change memory attributes. If doing so, do not mark a section with the TLS directory executable.

If using Visual C++:

Arguments

This rule has the following output arguments:

  • section - Affected section name