microsoft / microsoft/windows-container-tools
[BUG] LogMonitor.exe being flagged for BA2008 for missing ControlFlowGuard in BinSkim
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 277
- Forks
- 77
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
BimSkim tool is flagging LogMonitor.exe because it is not being compiled with appropriate flags:
##[warning]1. BinSkim Error BA2008 - File: out/release-x64/..................../LogMonitor.exe.
Signature: cf1589786cb2eb6e24ec7e3ab21a5fa5c83c77f9eefdaf11e7475e382eaa14ab
Tool: BinSkim: Rule: BA2008 (EnableControlFlowGuard). https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2008EnableControlFlowGuard
'LogMonitor.exe' does not enable the control flow guard (CFG) mitigation.
To resolve this issue, pass /guard:cf on both the compiler and linker command lines. Binaries also require the /DYNAMICBASE linker option in order to enable CFG.
For VC projects use ItemDefinitionGroup - ClCompile - ControlFlowGuard property with 'Guard' value, link CFG property will be set automatically.
To Reproduce
Download BinSkim tool (https://www.nuget.org/packages/Microsoft.CodeAnalysis.BinSkim) and run:
BinSkim.exe analyze ServiceMonitor.exe
Expected behavior
LogMonitor.exe should be compiled with ControlFlowGuard flag and should NOT be flagged by binskim BA2008.
Screenshots
If applicable, add screenshots to help explain your problem.
Configuration
-Tool: LogMonitor
-Version: 2.1.1
Additional context
Add any other context about the problem here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the build configuration that produces LogMonitor.exe and review how its compiler and linker flags are set. Run BinSkim against the built executable, using the reported BA2008 requirement as the check; done means LogMonitor.exe no longer triggers the EnableControlFlowGuard warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100