C-Based Toolchain Hardening - Revision history

Wichers: Fix a broken link and one misspelling.

2019-01-25T23:27:53Z

Fix a broken link and one misspelling.

Jmanico: Reptoline fixes being addresses

2018-03-23T03:00:20Z

Reptoline fixes being addresses

Jmanico: added Reptoline fix for GCC 7.3+ and 8.1+ (Spectre/Meltdown defenses)

2018-03-23T02:55:33Z

added Reptoline fix for GCC 7.3+ and 8.1+ (Spectre/Meltdown defenses)

Jmanico: /* GCC/Binutils */

2017-06-20T15:36:56Z

‎GCC/Binutils

Jmanico: /* GCC/Binutils */

2017-06-20T15:36:05Z

‎GCC/Binutils

Jmanico: /* Visual Studio */

2016-04-29T00:03:12Z

‎Visual Studio

Jmanico: control flow guard cleanup

2015-04-22T18:48:09Z

control flow guard cleanup

Jmanico: update on /guard

2015-04-22T18:45:38Z

update on /guard

Jmanico: added start to control flow guard

2015-04-07T17:29:22Z

added start to control flow guard

Achim: category "Cheat Sheet" changed to (more commonly used) "Cheatsheets"

2014-11-04T19:32:48Z

category "Cheat Sheet" changed to (more commonly used) "Cheatsheets"

@@ Line 9: / Line 9: @@
 The OWASP [http://code.google.com/p/owasp-esapi-cplusplus/source ESAPI C++] project eats its own dog food. Many of the examples you will see in this article come directly from the ESAPI C++ project.
-Finally, a [[Category:Cheatsheets|Cheat Sheet]] is available for those who desire a terse treatment of the material. Please visit [[C-Based_Toolchain_Hardening_Cheat_Sheet|C-Based Toolchain Hardening Cheat Sheet]] for the abbreviated version.
+Finally, a [[:Category:Cheatsheets|Cheat Sheet]] is available for those who desire a terse treatment of the material. Please visit [[C-Based_Toolchain_Hardening_Cheat_Sheet|C-Based Toolchain Hardening Cheat Sheet]] for the abbreviated version.
 == Wisdom ==
@@ Line 51: / Line 51: @@
 In addition, you should use other relevant flags, such as <tt>-fno-omit-frame-pointer</tt>. Ensuring a frame pointer exists makes it easier to decode stack traces. Since debug builds are not shipped, its OK to leave symbols in the executable. Programs with debug information do not suffer performance hits. See, for example, [http://gcc.gnu.org/ml/gcc-help/2005-03/msg00032.html How does the gcc -g option affect performance?]
-Finally, you should ensure your project includes additional diagnostic libraries, such as <tt>dmalloc</tt> and [http://code.google.com/p/address-sanitizer/ Address Sanitizer]. A comparison of some memory checking tools can be found at [http://code.google.com/p/address-sanitizer/wiki/ComparisonOfMemoryTools Comparison Of Memory Tools]. If you don't include additional diagostics in debug builds, then you should start using them sinces its OK to find errors you are not looking for.
+Finally, you should ensure your project includes additional diagnostic libraries, such as <tt>dmalloc</tt> and [http://code.google.com/p/address-sanitizer/ Address Sanitizer]. A comparison of some memory checking tools can be found at [http://code.google.com/p/address-sanitizer/wiki/ComparisonOfMemoryTools Comparison Of Memory Tools]. If you don't include additional diagnostics in debug builds, then you should start using them since its OK to find errors you are not looking for.
 ==== Release Builds ====

← Older revision		Revision as of 03:00, 23 March 2018
Line 44:		Line 44:

	<tt>-O0</tt> turns off optimizations and <tt>-g3</tt> ensures maximum debug information is available. You may need to use <tt>-O1</tt> so some analysis is performed. Otherwise, your debug build will be missing a number of warnings not present in release builds. <tt>-g3</tt> ensures maximum debugging information is available for the debug session, including symbolic constants and <tt>#defines</tt>. <tt>-ggdb</tt> includes extensions to help with a debug session under GDB. For completeness, Jan Krachtovil stated <tt>-ggdb</tt> currently has no effect in a private email.		<tt>-O0</tt> turns off optimizations and <tt>-g3</tt> ensures maximum debug information is available. You may need to use <tt>-O1</tt> so some analysis is performed. Otherwise, your debug build will be missing a number of warnings not present in release builds. <tt>-g3</tt> ensures maximum debugging information is available for the debug session, including symbolic constants and <tt>#defines</tt>. <tt>-ggdb</tt> includes extensions to help with a debug session under GDB. For completeness, Jan Krachtovil stated <tt>-ggdb</tt> currently has no effect in a private email.
		+
		+	Release builds should also consider the configuration pair of <tt>-mfunction-return=thunk</tt> and <tt>-mindirect-branch=thunk</tt>. These are the "Reptoline" fix which is an indirect branch used to thwart speculative execution CPU vulnerabilities such as Spectre and Meltdown. The CPU cannot tell what code to [speculatively] execute because it is an indirect (as opposed to a direct) branch. This is an extra layer of indirection, like calling a pointer through a pointer.

	Debug build should also define <tt>DEBUG</tt>, and ensure <tt>NDEBUG</tt> is not defined. <tt>NDEBUG</tt> removes "program diagnostics"; and has undesirable behavior and side effects which discussed below in more detail. The defines should be present for all code, and not just the program. You use it for all code (your program and included libraries) because you need to know how they fail too (remember, you take the bug report - not the third party library).		Debug build should also define <tt>DEBUG</tt>, and ensure <tt>NDEBUG</tt> is not defined. <tt>NDEBUG</tt> removes "program diagnostics"; and has undesirable behavior and side effects which discussed below in more detail. The defines should be present for all code, and not just the program. You use it for all code (your program and included libraries) because you need to know how they fail too (remember, you take the bug report - not the third party library).

@@ Line 509: / Line 509: @@
 |GCC 4.8
 |Enable [http://code.google.com/p/data-race-test/wiki/ThreadSanitizer ThreadSanitizer], a fast data race detector. Memory access instructions will be instrumented to detect data race bugs.
 |-
@@ Line 514: / Line 520: @@
 |Binutils 2.10
 |Reduces the ability of an attacker to load, manipulate, and dump shared objects.
 |-

@@ Line 488: / Line 488: @@
 |<nowiki>-fstack-check</nowiki>
 |GCC
-|Prevents the stack-pointer from moving into another memory region without accessing the stack guard-page.
+|Prevents the stack-pointer from moving into another memory region without accessing the stack guard-page. The "-fstack-check" remediation has some expense. It touches each page using a 4K stride to ensure the guard page is touched.
 |-
 |<nowiki>-Wstrict-overflow</nowiki>
 |GCC 4.2
-|Warn about optimizations taken due to <nowiki>[undefined]</nowiki> signed integer overflow assumptions. The "-fstack-check" remediation has some expense. It touches each page using a 4K stride to ensure the guard page is touched.
+|Warn about optimizations taken due to <nowiki>[undefined]</nowiki> signed integer overflow assumptions.
 |-

@@ Line 484: / Line 484: @@
 |GCC
 |Warn if a function is declared or defined without specifying the argument types.
 |-
 |<nowiki>-Wstrict-overflow</nowiki>
 |GCC 4.2
-|Warn about optimizations taken due to <nowiki>[undefined]</nowiki> signed integer overflow assumptions.
+|Warn about optimizations taken due to <nowiki>[undefined]</nowiki> signed integer overflow assumptions. The "-fstack-check" remediation has some expense. It touches each page using a 4K stride to ensure the guard page is touched.
 |-

@@ Line 682: / Line 682: @@
 |width="350pt"|Warning level 4, which includes most warnings.
 |-
 |<nowiki>/WAll</nowiki>

@@ Line 720: / Line 720: @@
 |<nowiki>/d2guard4 /link /guard:cf</nowiki>
 |Visual Studio 2015
-|<i>Control Flow Guard</i> ensure that all indirect-calls result in a jump to legal targets. Please note that /d2guard4 is a compiler switch and it needs to be used with /guard.  Also note that /guard is a linker switch and needs to be used with /d2guard4.
+|<i>Control Flow Guard</i> ensure that all indirect-calls result in a jump to legal targets. Please note that /d2guard4 is a compiler switch and it needs to be used with /guard.  Also note that /guard is a linker switch and needs to be used with /d2guard4. Please note than <i>Control Flow Guard</i> protects against attacks like heap sprays and no-op sleds as well.
 |}

@@ Line 716: / Line 716: @@
 |Visual Studio 2005 SP1
 |Aggressively applies stack protections to a source file to help detect some categories of stack based buffer overruns.<sup>b</sup>
 |}