UPX disables NX in Linux

[ThinerDAS]

What's the problem (or question)?

When packing with upx in Linux, executables with their NX set failed to set NX when packed. That is, the stack/heap/etc. of an upx-packed executable are always executable(PROT_READ implies PROT_EXEC in mmap).

What should have happened?

An executable with GNU_STACK in its program header (implying that the kernel should unset READ_IMPLIES_EXEC for the executable), when packed, should keep their stack+heap+bss not executable.

Do you have an idea for a solution?

Preserve the personality() ..?

How can we reproduce the issue?

Fairly easy. Following steps are self-explanatory.
(Tested on Ubuntu 16.04)

$ cp /bin/cat .
$ ~/Source/upx-3.92-amd64_linux/upx cat 
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2016
UPX 3.92        Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 11th 2016

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
     52080 ->     23264   44.67%   linux/amd64   cat                           

Packed 1 file.
$ cat /proc/self/maps
00400000-0040c000 r-xp 00000000 08:02 58720280                           /bin/cat
0060b000-0060c000 r--p 0000b000 08:02 58720280                           /bin/cat
0060c000-0060d000 rw-p 0000c000 08:02 58720280                           /bin/cat
01896000-018b7000 rw-p 00000000 00:00 0                                  [heap]
7f74015c2000-7f7401a4d000 r--p 00000000 08:02 115870539                  /usr/lib/locale/locale-archive
7f7401a4d000-7f7401c0c000 r-xp 00000000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7f7401c0c000-7f7401e0c000 ---p 001bf000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7f7401e0c000-7f7401e10000 r--p 001bf000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7f7401e10000-7f7401e12000 rw-p 001c3000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7f7401e12000-7f7401e16000 rw-p 00000000 00:00 0 
7f7401e16000-7f7401e3c000 r-xp 00000000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7f740200e000-7f7402011000 rw-p 00000000 00:00 0 
7f7402017000-7f740203b000 rw-p 00000000 00:00 0 
7f740203b000-7f740203c000 r--p 00025000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7f740203c000-7f740203d000 rw-p 00026000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7f740203d000-7f740203e000 rw-p 00000000 00:00 0 
7ffe9b66e000-7ffe9b68f000 rw-p 00000000 00:00 0                          [stack]
7ffe9b69c000-7ffe9b69e000 r--p 00000000 00:00 0                          [vvar]
7ffe9b69e000-7ffe9b6a0000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
$ ./cat /proc/self/maps
00400000-0040c000 r-xp 00000000 00:00 0 
0040c000-0060b000 ---p 00000000 00:00 0 
0060b000-0060c000 r-xp 00000000 00:00 0 
0060c000-0060d000 rwxp 00000000 00:00 0 
01247000-01268000 rwxp 00000000 00:00 0                                  [heap]
7fd785750000-7fd785bdb000 r-xp 00000000 08:02 115870539                  /usr/lib/locale/locale-archive
7fd785bdb000-7fd785bde000 rwxp 00000000 00:00 0 
7fd785bde000-7fd785d9d000 r-xp 00000000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7fd785d9d000-7fd785f9d000 ---p 001bf000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7fd785f9d000-7fd785fa1000 r-xp 001bf000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7fd785fa1000-7fd785fa3000 rwxp 001c3000 08:02 20447425                   /lib/x86_64-linux-gnu/libc-2.23.so
7fd785fa3000-7fd785fa7000 rwxp 00000000 00:00 0 
7fd785fad000-7fd785fd1000 rwxp 00000000 00:00 0 
7fd785fd1000-7fd785ff7000 r-xp 00000000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7fd785ff7000-7fd7861f6000 ---p 00000000 00:00 0 
7fd7861f6000-7fd7861f7000 r-xp 00025000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7fd7861f7000-7fd7861f8000 rwxp 00026000 08:02 20447426                   /lib/x86_64-linux-gnu/ld-2.23.so
7fd7861f8000-7fd7861f9000 rwxp 00000000 00:00 0 
7ffd4319f000-7ffd431c0000 rwxp 00000000 00:00 0                          [stack]
7ffd431f3000-7ffd431f5000 r--p 00000000 00:00 0                          [vvar]
7ffd431f5000-7ffd431f7000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
$ 

Please tell us details about your environment.

• UPX version used (upx --version):

upx 3.92
NRV data compression library 0.84
UCL data compression library 1.03
zlib data compression library 1.2.3
LZMA SDK version 4.43
Copyright (C) 1996-2016 Markus Franz Xaver Johannes Oberhumer
Copyright (C) 1996-2016 Laszlo Molnar
Copyright (C) 2000-2016 John F. Reiser
Copyright (C) 2002-2016 Jens Medoch
Copyright (C) 1995-2005 Jean-loup Gailly and Mark Adler
Copyright (C) 1999-2006 Igor Pavlov
UPX comes with ABSOLUTELY NO WARRANTY; for details type 'upx -L'.

• Operating System and version:

Ubuntu 16.04

• CPU architecture:

$ uname -a
Linux [computer-name] 4.10.3-041003-generic #201703142331 SMP Wed Mar 15 03:32:45 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux