Process heap is always executable

ID PE147 Level ERROR Category Security

Description

The load configuration directory has the HEAP_CREATE_ENABLE_EXECUTE heap flag set for the executable. Process default heap will be always executable even if the DEP (data execution prevention) security mitigation is enabled. This will allow self-modifying code (including exploits) to be executed easily without the need to manipulate heap memory attributes.

Mitigation

If using Visual C++:

  • Make sure you do not change the ProcessHeapFlags field value in the _load_config_used symbol somewhere in the application code.

Arguments

This rule has no output arguments.