alibaba / alibaba/MNNKit

facedetection包含的libmnnfacedetection.so存在编译选项相关安全风险,请关注解决

Open
#54 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Objective-C
Stars
702
Forks
119
PR merge metrics
No merged PRs in 30d

Description

facedetection-0.0.5.aar中的resources\jni\arm64-v8a\libmnnfacedetection.so,没有使用-fstack-protector-all或-fstack-protector-strong编译选项。可能导致缓冲区溢出攻击漏洞,导致应用程序被恶意劫持或崩溃。
按编译器不同:
1.GCC4.9版本及以上可使用-fstack-protector-strong进行加固
2.GCC4.9版本以下可使用-fstack-protector-all进行加固

请facedetection提供经过安全的编译选项加固后的so,谢谢

参考链接:https://android-developers.googleblog.com/2016/07/protecting-android-with-more-linux.html

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with facedetection-0.0.5.aar and inspect resources/jni/arm64-v8a/libmnnfacedetection.so, then locate the build configuration that produces this native library. Verify the rebuilt .so uses the requested stack-protection compiler option and confirm the secured library is included in the AAR.

Written by the indexing model from the issue text.

Assessment

Tech stack
android
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.