Skip to content

React Native 0.71.3 generates .so files that are not stack canary protected #36870

Description

@devtestsh

Description

Spinning up a new project using React Native 0.71.3 will generate various .so files packaged in the Android APK generated when running ./gradlew assembleRelease . Of these .so files, some were found to not be stack canary protected using security tools like MobSF, checksec, or readelf. This happens despite placing the below in my android/app/build.gradle configurations.

externalNativeBuild{ cmake{ cppFlags "-fstack-protector-all" } }

These were the files we found so far:
libreact_debug
libreact_render_debug
libreact_utils
libruntimeexecutor

React Native Version

0.71.3

Output of npx react-native info

System:
OS: Windows 10 10.0.19045
CPU: (8) x64 11th Gen Intel(R) Core(TM) i5-1145G7 @ 2.60GHz
Memory: 2.64 GB / 15.69 GB
Binaries:
Node: 18.15.0 - C:\Program Files\nodejs\node.EXE
Yarn: Not Found
npm: 9.5.0 - C:\Program Files\nodejs\npm.CMD
Watchman: Not Found
SDKs:
Android SDK: Not Found
Windows SDK: Not Found
IDEs:
Android Studio: AI-221.6008.13.2211.9619390
Visual Studio: Not Found
Languages:
Java: 11.0.15.1 - C:\Program Files\Common Files\Oracle\Java\javapath\javac.EXE
npmPackages:
@react-native-community/cli: ^11.1.2 => 10.2.2
react: ^18.2.0 => 18.2.0
react-native: ^0.71.3 => 0.71.6
react-native-windows: Not Found
npmGlobalPackages:
react-native: Not Found

Steps to reproduce

  1. Create new react app
  2. npm install
  3. cd android && ./gradlew assembleRelease
  4. cd app/build/outputs/release/apk/release/
  5. apktool d app-release.apk
  6. cd app-release/lib/x86_64
  7. readelf -s libreact_utils.so OR readelf -S libreact_utils.so

It can be noted here that the libreact_utils.so does not have stack canary symbols or stack_chk_fail function implemented.

Snack, code example, screenshot, or link to a repository

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions