React Native 0.71.3 generates .so files that are not stack canary protected #36870

devtestsh · 2023-04-11T10:04:57Z

Description

Spinning up a new project using React Native 0.71.3 will generate various .so files packaged in the Android APK generated when running ./gradlew assembleRelease . Of these .so files, some were found to not be stack canary protected using security tools like MobSF, checksec, or readelf. This happens despite placing the below in my android/app/build.gradle configurations.

externalNativeBuild{ cmake{ cppFlags "-fstack-protector-all" } }

These were the files we found so far:
libreact_debug
libreact_render_debug
libreact_utils
libruntimeexecutor

React Native Version

0.71.3

Output of `npx react-native info`

System:
OS: Windows 10 10.0.19045
CPU: (8) x64 11th Gen Intel(R) Core(TM) i5-1145G7 @ 2.60GHz
Memory: 2.64 GB / 15.69 GB
Binaries:
Node: 18.15.0 - C:\Program Files\nodejs\node.EXE
Yarn: Not Found
npm: 9.5.0 - C:\Program Files\nodejs\npm.CMD
Watchman: Not Found
SDKs:
Android SDK: Not Found
Windows SDK: Not Found
IDEs:
Android Studio: AI-221.6008.13.2211.9619390
Visual Studio: Not Found
Languages:
Java: 11.0.15.1 - C:\Program Files\Common Files\Oracle\Java\javapath\javac.EXE
npmPackages:
@react-native-community/cli: ^11.1.2 => 10.2.2
react: ^18.2.0 => 18.2.0
react-native: ^0.71.3 => 0.71.6
react-native-windows: Not Found
npmGlobalPackages:
react-native: Not Found

Steps to reproduce

Create new react app
npm install
cd android && ./gradlew assembleRelease
cd app/build/outputs/release/apk/release/
apktool d app-release.apk
cd app-release/lib/x86_64
readelf -s libreact_utils.so OR readelf -S libreact_utils.so

It can be noted here that the libreact_utils.so does not have stack canary symbols or stack_chk_fail function implemented.

Snack, code example, screenshot, or link to a repository

The text was updated successfully, but these errors were encountered:

github-actions · 2023-04-11T10:05:13Z

⚠️	Newer Version of React Native is Available!
ℹ️	You are on a supported minor version, but it looks like there's a newer patch available. Please upgrade to the highest patch for your minor or latest and verify if the issue persists (alternatively, create a new project and repro the issue in it). If it does not repro, please let us know so we can close out this issue. This helps us ensure we are looking at issues that still exist in the most recent releases.

cortinico · 2023-04-11T10:33:30Z

This happens despite placing the below in my android/app/build.gradle configurations.

That happens because those .so files are prebuilt.
You can't specify custom flags as the compilation for those libraries already happened.
If you wish to customize the compilation of those libraries, you should switch to a build from source on Android: https://reactnative.dev/contributing/how-to-build-from-source

devtestsh · 2023-04-13T03:01:48Z

@cortinico Thank you for your prompt reply. I'm currently trying to remedy the issue by building from source, but I do understand building from source is not the recommended approach of development and would require the node_modules to not be updated as well.

Sorry if I am not really well-versed on this matter, and am not sure if you would be able to advise, but would like to inquire why these source files are not built with stack canary flags as a default when prebuilt?

It seems to be a common enough use case for security requirements for developers. I understand the intention of the prebuilt files are for quicker build times, but it seems the ability to add these additional configs requires quite an atypical dev flow, as well as lots of additional debugging on the ReactAndroid etc. config files just to force this flag in. Additionally it would not be able to be maintained on version control unless I remove node_modules from .gitignore.

cortinico · 2023-04-13T14:48:52Z

Sorry if I am not really well-versed on this matter, and am not sure if you would be able to advise, but would like to inquire why these source files are not built with stack canary flags as a default when prebuilt?

I've done further investigation and noticed that we do have the -fstack-protector-strong flag set on all the compilation targets.

You can verify this by yourself by cloning the repo and running cd packages/react-native/ && ./gradlew build. The build will run and inside packages/react-native/ReactAndroid/.cxx you'll find the temp of the compilation flags.

Here the flags used for a debug run I did locally for the target react_utils:

# =============================================================================
# Object build statements for SHARED_LIBRARY target react_utils


#############################################
# Order-only phony target for react_utils

build cmake_object_order_depends_target_react_utils: phony || cmake_object_order_depends_target_boost cmake_object_order_depends_target_double-conversion cmake_object_order_depends_target_fmt cmake_object_order_depends_target_folly_runtime cmake_object_order_depends_target_glog cmake_object_order_depends_target_glog_init cmake_object_order_depends_target_react_debug

build ReactCommon/react/utils/CMakeFiles/react_utils.dir/ManagedObjectWrapper.mm.o: CXX_COMPILER__react_utils_Debug /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactCommon/react/utils/ManagedObjectWrapper.mm || cmake_object_order_depends_target_react_utils
  DEFINES = -Dreact_utils_EXPORTS
  DEP_FILE = ReactCommon/react/utils/CMakeFiles/react_utils.dir/ManagedObjectWrapper.mm.o.d
  FLAGS = -DANDROID -fdata-sections -ffunction-sections -funwind-tables -fstack-protector-strong -no-canonical-prefixes -D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fexceptions -frtti -stdlib=libc++ -g  -fno-limit-debug-info -fPIC -Wall -Werror -std=c++17 -fexceptions -frtti -Wpedantic -Wno-gnu-zero-variadic-macro-arguments -DLOG_TAG=\"Fabric\" -DFOLLY_NO_CONFIG=1 -DFOLLY_HAVE_CLOCK_GETTIME=1 -DFOLLY_USE_LIBCPP=1 -DFOLLY_MOBILE=1 -DFOLLY_HAVE_RECVMMSG=1 -DFOLLY_HAVE_PTHREAD=1 -DFOLLY_HAVE_XSI_STRERROR_R=1
  INCLUDES = -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactCommon -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/glog/exported -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/src/main/jni/first-party/fbgloginit/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/folly/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/double-conversion/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/boost/boost_1_76_0 -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/fmt/include
  OBJECT_DIR = ReactCommon/react/utils/CMakeFiles/react_utils.dir
  OBJECT_FILE_DIR = ReactCommon/react/utils/CMakeFiles/react_utils.dir

build ReactCommon/react/utils/CMakeFiles/react_utils.dir/RunLoopObserver.cpp.o: CXX_COMPILER__react_utils_Debug /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactCommon/react/utils/RunLoopObserver.cpp || cmake_object_order_depends_target_react_utils
  DEFINES = -Dreact_utils_EXPORTS
  DEP_FILE = ReactCommon/react/utils/CMakeFiles/react_utils.dir/RunLoopObserver.cpp.o.d
  FLAGS = -DANDROID -fdata-sections -ffunction-sections -funwind-tables -fstack-protector-strong -no-canonical-prefixes -D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fexceptions -frtti -stdlib=libc++ -g  -fno-limit-debug-info -fPIC -Wall -Werror -std=c++17 -fexceptions -frtti -Wpedantic -Wno-gnu-zero-variadic-macro-arguments -DLOG_TAG=\"Fabric\" -DFOLLY_NO_CONFIG=1 -DFOLLY_HAVE_CLOCK_GETTIME=1 -DFOLLY_USE_LIBCPP=1 -DFOLLY_MOBILE=1 -DFOLLY_HAVE_RECVMMSG=1 -DFOLLY_HAVE_PTHREAD=1 -DFOLLY_HAVE_XSI_STRERROR_R=1
  INCLUDES = -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactCommon -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/glog/exported -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/src/main/jni/first-party/fbgloginit/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/folly/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/double-conversion/. -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/boost/boost_1_76_0 -I/Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/third-party-ndk/fmt/include
  OBJECT_DIR = ReactCommon/react/utils/CMakeFiles/react_utils.dir
  OBJECT_FILE_DIR = ReactCommon/react/utils/CMakeFiles/react_utils.dir


# =============================================================================
# Link build statements for SHARED_LIBRARY target react_utils


#############################################
# Link the shared library /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_utils.so

build /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_utils.so: CXX_SHARED_LIBRARY_LINKER__react_utils_Debug ReactCommon/react/utils/CMakeFiles/react_utils.dir/ManagedObjectWrapper.mm.o ReactCommon/react/utils/CMakeFiles/react_utils.dir/RunLoopObserver.cpp.o | /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog_init.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_debug.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libfolly_runtime.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog.so build/third-party-ndk/double-conversion/libdouble-conversion.a build/third-party-ndk/boost/libboost.a build/third-party-ndk/fmt/libfmt.a || /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libfolly_runtime.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog_init.so /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_debug.so build/third-party-ndk/boost/libboost.a build/third-party-ndk/double-conversion/libdouble-conversion.a build/third-party-ndk/fmt/libfmt.a
  LANGUAGE_COMPILE_FLAGS = -DANDROID -fdata-sections -ffunction-sections -funwind-tables -fstack-protector-strong -no-canonical-prefixes -D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fexceptions -frtti -stdlib=libc++ -g  -fno-limit-debug-info
  LINK_FLAGS = -Wl,--build-id=sha1 -Wl,--no-rosegment -Wl,--fatal-warnings -Qunused-arguments -Wl,--no-undefined   -Wl,--build-id
  LINK_LIBRARIES = /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog_init.so  /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_debug.so  -llog  /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libfolly_runtime.so  /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libglog.so  build/third-party-ndk/double-conversion/libdouble-conversion.a  build/third-party-ndk/boost/libboost.a  build/third-party-ndk/fmt/libfmt.a   -latomic -lm
  OBJECT_DIR = ReactCommon/react/utils/CMakeFiles/react_utils.dir
  POST_BUILD = :
  PRE_LINK = :
  SONAME = libreact_utils.so
  SONAME_FLAG = -Wl,-soname,
  TARGET_FILE = /Users/ncor/fbsource/xplat/js/react-native-github/packages/react-native/ReactAndroid/build/intermediates/cxx/Debug/335v2y43/obj/arm64-v8a/libreact_utils.so
  TARGET_PDB = react_utils.so.dbg

oliemansm · 2023-05-05T10:13:54Z

Our security team raised the exact same issue for the same version. They also reported that those libraries are missing the FORTIFY protection. I do see a FORTIFY_SOURCE command line argument though. From this build log it seems like both measures are actually being applied for the prebuilt libs, but then when our security team investigates our app it appears that it actually is not applied. 🤷🏻‍♂️

Maybe something is going wrong in the build pipeline reverting/overriding these security measures resulting in final .so files that don't have them applied after all?

cortinico · 2023-05-05T10:21:24Z

I do see a FORTIFY_SOURCE command line argument though. From this build log it seems like both measures are actually being applied for the prebuilt libs, but then when our security team investigates our app it appears that it actually is not applied. 🤷🏻‍♂️

Could you provide more evidence that those flags are missing? How are they investigating the .so files? Is this something we can replicate locally somehow?

oliemansm · 2023-05-05T10:25:22Z

Sure. This is from their report.

The affected native libraries are all part of the split_config.arm64_v8a.apk. This file format is a zip file, which could be extracted using an archiving utility. A reverse engineering framework like Rizin11 or Radare212 could be used to verify if exploit mitigations have been enabled for a binary, by using the following command for Rizin:

$ rz-bin -s lib/arm64-v8a/libreact_utils.so|grep _chk

When no mitigations have been enabled, no output is given after execution of the command. If checks have been enabled, an output will look similar to the output below:

$ rz-bin -s lib/arm64-v8a/librrc_view.so|grep _chk
142 0x00010eb0 0x00010eb0 GLOBAL FUNC 16 imp.__vsnprintf_chk
144 0x00010f30 0x00010f30 GLOBAL FUNC 16 imp.__stack_chk_fail

The first line is for the FORTIFY_SOURCE obtain, which adds a check for all dangerous standard functions. The second line is for the stack canary protection.

The following libraries are missing stack canary protection:
• lib/arm64-v8a/libreact_utils.so
• lib/arm64-v8a/libreact_config.so
• lib/arm64-v8a/libreact_debug.so
• lib/arm64-v8a/libreact_render_telemetry.so
• lib/arm64-v8a/libruntimeexecutor.so
• lib/arm64-v8a/libreact_render_debug.so
• lib/arm64-v8a/libreanimated.so

The following libraries are missing the FORTIFY protection:
• lib/arm64-v8a/libreact_utils.so
• lib/arm64-v8a/libreact_config.so
• lib/arm64-v8a/libreact_debug.so
• lib/arm64-v8a/libreact_render_telemetry.so
• lib/arm64-v8a/libruntimeexecutor.so
• lib/arm64-v8a/libreact_render_debug.so
• lib/arm64-v8a/libreanimated.so
• lib/arm64-v8a/libreact_render_leakchecker.so
• lib/arm64-v8a/libreactperfloggerjni.so
• lib/arm64-v8a/libnative-filters.so
• lib/arm64-v8a/libreact_render_scheduler.so
• lib/arm64-v8a/libreact_codegen_rncore.so
• lib/arm64-v8a/librrc_scrollview.so
• lib/arm64-v8a/libreact_render_mounting.so
• lib/arm64-v8a/libjsc.so
• lib/arm64-v8a/libjsijniprofiler.so
• lib/arm64-v8a/libjsinspector.so
• lib/arm64-v8a/libreact_render_templateprocessor.so
• lib/arm64-v8a/librrc_textinput.so
• lib/arm64-v8a/libimagepipeline.so
• lib/arm64-v8a/libglog_init.so
• lib/arm64-v8a/librrc_unimplementedview.so
• lib/arm64-v8a/librrc_text.so
• lib/arm64-v8a/liblogger.so
• lib/arm64-v8a/libfb.so
• lib/arm64-v8a/libreact_render_attributedstring.so
• lib/arm64-v8a/libreact_render_graphics.so
• lib/arm64-v8a/libreact_render_imagemanager.so
• lib/arm64-v8a/libreact_render_componentregistry.so
• lib/arm64-v8a/libreact_render_textlayoutmanager.so
• lib/arm64-v8a/libreact_render_animations.so
• lib/arm64-v8a/librrc_root.so
• lib/arm64-v8a/libreact_render_core.so
• lib/arm64-v8a/librrc_image.so

cortinico · 2023-05-05T16:04:34Z

Sure. This is from their report.

Thanks this is really valuable. I'd love to have this looked into.
Also @kelset do you know someone at Microsoft that might help the investigation?

cortinico · 2023-05-05T17:09:52Z

Also this is up for grab. It's going to be a matter of adding missing flags to CMakeLists.txt files and verifying with rz-bin that those symbols are there as expected

kelset · 2023-05-09T09:28:09Z

sorry, can't think of anyone MSFT side that can take this up

dragorwyin · 2023-05-26T14:13:09Z

Hello, our support team raised the same issue for the React Native 0.71.0, tried to use:
externalNativeBuild { cmake { cppFlags "-fstack-protector-all" } }

in android/app/build.gradle under android / defaultConfig but it didn't help in any way.

cortinico · 2023-05-31T11:01:05Z

Hello, our support team raised the same issue for the React Native 0.71.0, tried to use:
externalNativeBuild { cmake { cppFlags "-fstack-protector-all" } }

This obviously has no effect as we distribute prebuilts, so you can't add new cppFlags as the compilation already happened on CI.

I identified a potential bug in the NDK that is causing this. I believe version 0.72 of React Native will fix this issue, so I ask you to try again once we'll have a stable version out.

SparshaSaha · 2023-06-15T08:29:58Z

Hi @cortinico , I am also being to repro the same issue on React Native 0.71.
Do we know whether react native 0.72 fixes this problem? If so, can we also maybe back port the fix to RN 0.71?
fyi - @kelset

SparshaSaha · 2023-06-15T10:38:56Z

Just FYI I think we can do this much easily even without using rz-bin.

Steps below (MAC):

Extracting an apk using any archiver (I personally rename the extension to .zip and use mac's default archiver to extract it)
Navigate inside the /lib/arm-xyz folder.
Create a new shell script e.g. soChecker.sh with the following code

for file in *; do
    echo $file
    strings $file | grep 'stack_chk_fail'
done

chmodx +x ./soChecker.sh
./soChecker.sh

This will print "__stack_chk_fail" for all files which have stack smash protection enabled. For files which do not have this, it will just print the file name.

The strings command will look for all printable strings inside the $file and pipe it to the adjacent grep command.

cortinico · 2023-06-15T15:03:23Z

Do we know whether react native 0.72 fixes this problem? If so, can we also maybe back port the fix to RN 0.71?

Yes I believe 0.72 will fix this issue to some degree.
Can someone try the latest RC of 72 and report back if there are some libraries that are still not stack protected?

SparshaSaha · 2023-06-20T13:41:58Z

@cortinico let me check that.

SparshaSaha · 2023-06-20T13:54:48Z

@cortinico @kelset @dragorwyin
I downloaded ReactAndroid~0.72-rc6 from maven and it looks like the following .so files are still not stack protected.

libreact_config.so
libreact_debug.so
libreact_render_debug.so
libreact_render_telemetry.so
libreact_utils.so
libruntimeexecutor.so

SparshaSaha · 2023-06-20T14:01:43Z

These not-stack-protected .so files are common for all architectures (arm68-v8a, armeabi-v7a, x86, x86_64).

SparshaSaha · 2023-06-22T10:18:09Z

@cortinico @kelset @dragorwyin this PR: #38018 should solve the stack_chk_fail part of this issue.

cortinico · 2023-06-22T16:07:29Z

I downloaded ReactAndroid~0.72-rc6 from maven and it looks like the following .so files are still not stack protected.

Could you clarify which file in the .aar is not stack protected (as there are several called libreact_config.so, one per architecture + one per prefab/non-prefab)?

dragorwyin · 2023-06-23T09:06:36Z

Hello, as it's essential to my team, I need to ask: what is the estimated fixing date for this one? If there is any?

cortinico · 2023-06-23T10:17:04Z

Hello, as it's essential to my team, I need to ask: what is the estimated fixing date for this one? If there is any?

There are no ETAs

SparshaSaha · 2023-06-23T10:37:35Z

@cortinico I am not sure what prefab/non-prefab is but the "__stack_chk_fail" string is missing for the above shared objects in all architectures. x86, x86_64, armeabi-v7a and arm68-v8a

cortinico · 2023-06-23T10:42:04Z

@cortinico I am not sure what prefab/non-prefab is but the "__stack_chk_fail" string is missing for the above shared objects in all architectures. x86, x86_64, armeabi-v7a and arm68-v8a

What I mean is that if you download this file:
https://repo1.maven.org/maven2/com/facebook/react/react-android/0.72.0/react-android-0.72.0-release.aar

and unzip it, search for libreact_render_debug.so you will have 8 of them:

jni/arm64-v8a/libreact_render_debug.so
jni/armeabi-v7a/libreact_render_debug.so
jni/x86/libreact_render_debug.so
jni/x86_64/libreact_render_debug.so
prefab/modules/react_render_debug/libs/android.arm64-v8a/libreact_render_debug.so
prefab/modules/react_render_debug/libs/android.armeabi-v7a/libreact_render_debug.so
prefab/modules/react_render_debug/libs/android.x86/libreact_render_debug.so
prefab/modules/react_render_debug/libs/android.x86_64/libreact_render_debug.so

which one have you checked @SparshaSaha ?

cortinico · 2023-06-23T10:44:25Z

as for example, I just checked jni/arm64-v8a/libreact_render_debug.so and I could see a __stack_chk_fail so I'm unsure what are you looking at.

SparshaSaha · 2023-06-23T10:47:10Z

Let me take a look again. I will report back here once I have an answer

SparshaSaha · 2023-06-23T14:31:55Z

@cortinico I just downloaded the release 0.72 and I checked jni/arm64-v8a/lib_react_render_debug.so.

But unfortunately I do not see any stack_chk_fail string inside it. I am not sure how we are seeing different things on the same .so. I might be doing something wrong.

I used the $strings command then then piped it into grep.

To confirm once again, I tried to search for it by opening the file in a code editor.

cortinico · 2023-06-23T17:04:03Z

But unfortunately I do not see any stack_chk_fail string inside it. I am not sure how we are seeing different things on the same .so.

You're correct. That was my fault. I was looking at a stale .aar I had downloaded previously. We're looking into doing the NDK 25 update that will potentially fix this issue in the immediate future

dragorwyin · 2023-07-19T07:15:48Z

Hello, just kindly pinging ;) Any update here or is it stuck? Thank you!

cortinico · 2023-07-19T08:46:12Z

Hello, just kindly pinging ;) Any update here or is it stuck? Thank you!

Currently blocked by this:

Bump NDK to 25 #37974

erich04 · 2023-08-25T07:05:12Z

Hello guys, any plan for this issue? :)

cortinico · 2023-09-11T14:29:53Z

Hi all,
I was able to look further into this issue and, given that we also merged NDK 25, I'm happy to provide a resolution.

I've verified that we build with -fstack-protector-strong, which adds stack protection only for functions which contains a stack buffer. That's the preferred solution as it adds security protection without unnecessarily compromising performances (see https://stackoverflow.com/a/68917178 and other metarial on this topic).

That being said, if you attempt to search for stack_chk_fail inside the .so files, you'll notice that some of those .so files don't have it. Specifically:

./libruntimeexecutor.so
./libreact_render_debug.so

Those two .so files are effectively empty in release. They contain no symbols. Even if you were to attempt to build with -fstack-protector-all, you still won't be able to see the stack_chk_fail string as there are no method calls there.
You can see why those files are empty in debug by checking the headers files setup like here: https://github.com/facebook/react-native/blob/c91688eebad98d86e1d696de9a6ed3cbf7350bf6/packages/react-native/ReactCommon/react/renderer/debug/flags.h

./libreact_utils.so
./libreact_config.so
./libreact_debug.so

Those 3 .so files instead contain method calls, but those methods don't contain stack buffer calls, so there are no stack_chk_fail strings inside them. This is consistent with us usign -fstack-protector-strong.

We won't be adding -fstack-protector-all as this will add a performance hit for no effective security gain. If you're interested in building .so files using -fstack-protector-all, you can do so by switching to a build from source (see https://reactnative.dev/contributing/how-to-build-from-source)

dragorwyin · 2023-10-02T09:15:19Z

Hello @cortinico, sorry for writing on closed ticket, but I think it's the best place to just ask about it.
After updating the React Native from 0.71.0 to 0.72.4 there is a new library called libcom_<project_name>.so and it's not stack canary protected also. Do you have any idea what could be the source of that file, is it safe to not have stack canary on this file and what is the purpose of such a file?
Sorry if the question can sounds stupid but I'm a newbie in mobile native libraries :)

cortinico · 2023-10-02T18:54:26Z

Hello @cortinico, sorry for writing on closed ticket, but I think it's the best place to just ask about it.

Sadly commenting on closed issues it's not the right place to ask this questions.
Please open a new issue.

devtestsh added the Needs: Triage 🔍 label Apr 11, 2023

github-actions bot added the Newer Patch Available label Apr 11, 2023

cortinico closed this as completed Apr 11, 2023

cortinico added Resolution: Answered When the issue is resolved with a simple answer and removed Needs: Triage 🔍 Newer Patch Available labels Apr 11, 2023

cortinico reopened this May 5, 2023

cortinico added Needs: React Native Team Attention and removed Resolution: Answered When the issue is resolved with a simple answer labels May 5, 2023

cortinico added the Help Wanted Issues ideal for external contributors. label May 5, 2023

SparshaSaha mentioned this issue Jun 22, 2023

Build React Native Shared Objects with Stack Smash Protection #38018

Closed

cortinico closed this as completed Sep 11, 2023

cortinico mentioned this issue Sep 11, 2023

Security Issues About Binary Packages #39252

Closed

dragorwyin mentioned this issue Oct 3, 2023

React Native generates libcom_<project_name>.so without stack canary protection #39773

Closed

cortinico mentioned this issue Sep 17, 2024

React Native Library .so files are not fortified #46537

Closed

muralitharana mentioned this issue Oct 8, 2024

Android builds, .so files are not stack canary protected and the binary does not have any fortified functions android/ndk#2085

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

React Native 0.71.3 generates .so files that are not stack canary protected #36870

React Native 0.71.3 generates .so files that are not stack canary protected #36870

devtestsh commented Apr 11, 2023

github-actions bot commented Apr 11, 2023

cortinico commented Apr 11, 2023

devtestsh commented Apr 13, 2023 •

edited

Loading

cortinico commented Apr 13, 2023

oliemansm commented May 5, 2023

cortinico commented May 5, 2023

oliemansm commented May 5, 2023

cortinico commented May 5, 2023

cortinico commented May 5, 2023

kelset commented May 9, 2023

dragorwyin commented May 26, 2023

cortinico commented May 31, 2023

SparshaSaha commented Jun 15, 2023

SparshaSaha commented Jun 15, 2023 •

edited

Loading

cortinico commented Jun 15, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 22, 2023

cortinico commented Jun 22, 2023

dragorwyin commented Jun 23, 2023 •

edited

Loading

cortinico commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023 •

edited

Loading

cortinico commented Jun 23, 2023

cortinico commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023 •

edited

Loading

cortinico commented Jun 23, 2023

dragorwyin commented Jul 19, 2023

cortinico commented Jul 19, 2023

erich04 commented Aug 25, 2023

cortinico commented Sep 11, 2023

dragorwyin commented Oct 2, 2023 •

edited

Loading

cortinico commented Oct 2, 2023

React Native 0.71.3 generates .so files that are not stack canary protected #36870

React Native 0.71.3 generates .so files that are not stack canary protected #36870

Comments

devtestsh commented Apr 11, 2023

Description

React Native Version

Output of npx react-native info

Steps to reproduce

Snack, code example, screenshot, or link to a repository

github-actions bot commented Apr 11, 2023

cortinico commented Apr 11, 2023

devtestsh commented Apr 13, 2023 • edited Loading

cortinico commented Apr 13, 2023

oliemansm commented May 5, 2023

cortinico commented May 5, 2023

oliemansm commented May 5, 2023

cortinico commented May 5, 2023

cortinico commented May 5, 2023

kelset commented May 9, 2023

dragorwyin commented May 26, 2023

cortinico commented May 31, 2023

SparshaSaha commented Jun 15, 2023

SparshaSaha commented Jun 15, 2023 • edited Loading

cortinico commented Jun 15, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 20, 2023

SparshaSaha commented Jun 22, 2023

cortinico commented Jun 22, 2023

dragorwyin commented Jun 23, 2023 • edited Loading

cortinico commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023 • edited Loading

cortinico commented Jun 23, 2023

cortinico commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023

SparshaSaha commented Jun 23, 2023 • edited Loading

cortinico commented Jun 23, 2023

dragorwyin commented Jul 19, 2023

cortinico commented Jul 19, 2023

erich04 commented Aug 25, 2023

cortinico commented Sep 11, 2023

dragorwyin commented Oct 2, 2023 • edited Loading

cortinico commented Oct 2, 2023

Output of `npx react-native info`

devtestsh commented Apr 13, 2023 •

edited

Loading

SparshaSaha commented Jun 15, 2023 •

edited

Loading

dragorwyin commented Jun 23, 2023 •

edited

Loading

SparshaSaha commented Jun 23, 2023 •

edited

Loading

SparshaSaha commented Jun 23, 2023 •

edited

Loading

dragorwyin commented Oct 2, 2023 •

edited

Loading