[RULE REQUEST] Enable Stack Clash Protection

Rule Proposal: Enable Stack Clash Protection

Rule metadata

• Id: BA3005
• Name: EnableStackClashProtection

Rule descriptions

• Full: This check ensures that stack clash protection is enabled. Each program running on a computer uses a special memory region called the stack. This memory region is special because it grows automatically when the program needs more stack memory. But if it grows too much and gets too close to another memory region, the program may confuse the stack with the other memory region. An attacker can exploit this confusion to overwrite the stack with the other memory region, or the other way around. Use the compiler flags '-fstack-clash-protection' to enable this.

Platform & applicability

• Platform: Unix
• Applicable to: Linux (ELF) binaries
• Not applicable to: Windows

User-facing strings

• Fail: The Stack Clash Protection is missing from this binary, so the stack from '{0}' can clash/colide with another memory region. Ensure you are compiling with the compiler flags '-fstack-clash-protection' to address this.
• Pass: The Stack Clash Protection was present, so '{0}' is protected.

Links/Additional Information

https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-gcc/

Implementation Notes

This should only be applied if you are compiling on GCC 8 or later.

How to resolve

-fstack-clash-protection

Review the merged pull requests #379 and #387 first, since they are linked to this request. Verify that rule BA3005 covers Linux ELF binaries, is limited to GCC 8 or later, reports the specified pass and fail strings, and excludes Windows.