microsoft / microsoft/windows-container-tools

[BUG] LogMonitor.exe being flagged for BA2008 for missing ControlFlowGuard in BinSkim

Open
#216 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
277
Forks
77
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
BimSkim tool is flagging LogMonitor.exe because it is not being compiled with appropriate flags:

##[warning]1. BinSkim Error BA2008 - File: out/release-x64/..................../LogMonitor.exe.  
Signature: cf1589786cb2eb6e24ec7e3ab21a5fa5c83c77f9eefdaf11e7475e382eaa14ab
Tool: BinSkim: Rule: BA2008 (EnableControlFlowGuard). https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2008EnableControlFlowGuard
'LogMonitor.exe' does not enable the control flow guard (CFG) mitigation.
To resolve this issue, pass /guard:cf on both the compiler and linker command lines. Binaries also require the /DYNAMICBASE linker option in order to enable CFG.
For VC projects use ItemDefinitionGroup - ClCompile - ControlFlowGuard property with 'Guard' value, link CFG property will be set automatically.

To Reproduce
Download BinSkim tool (https://www.nuget.org/packages/Microsoft.CodeAnalysis.BinSkim) and run:

BinSkim.exe analyze ServiceMonitor.exe

Expected behavior
LogMonitor.exe should be compiled with ControlFlowGuard flag and should NOT be flagged by binskim BA2008.

Screenshots
If applicable, add screenshots to help explain your problem.

Configuration
-Tool: LogMonitor
-Version: 2.1.1

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the build configuration that produces LogMonitor.exe and review how its compiler and linker flags are set. Run BinSkim against the built executable, using the reported BA2008 requirement as the check; done means LogMonitor.exe no longer triggers the EnableControlFlowGuard warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
build-system, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.