Security Policy

Repository: https://github.com/ECLS-Studio/rerius

Supported Versions#

Version	Status	Security Updates
1.0.x	Active (current)	Yes
< 1.0	End of life	No

Scope#

Rerius parses and analyzes untrusted binary files. The following are in scope:

Memory safety bugs when parsing malformed ELF, PE, or Mach-O files (buffer overflows, out-of-bounds reads/writes, use-after-free, integer overflows in size/offset calculations)
Vulnerabilities in the N-API addon (rerius.node) exploitable when processing untrusted binaries via the JS API
Path traversal in the REST server (js/server/server.js)
Denial-of-service via malformed input (infinite loops, excessive memory allocation)
Bypass of instruction validity checks in the IVF module that could cause crashes
Bypass of the fault isolation layer (dax_guard.h) that allows a malformed binary to crash the whole program rather than just recovering one pass

Out of scope:

Issues requiring physical access to the machine
Theoretical vulnerabilities without a practical exploit
The emulator or symbolic execution producing incorrect output on edge-case inputs: these are accuracy bugs, not security bugs, and should be filed as regular issues
Issues in third-party tools used to build Rerius
Vulnerabilities in binaries analyzed by Rerius: Rerius does not execute analyzed files

Defense-in-Depth Model (v1.0.0+)#

As of v1.0.0, Rerius uses a three-layer fault isolation model loosely inspired by microkernel design. It is intended to contain the effect of malformed input, not to eliminate memory-safety risk outright.

Layer 1: Input validation (DAX_GUARD_BIN, DAX_GUARD_FUNC): every public analysis entry point validates bin->data, bin->size, and all counter fields against DAX_MAX_* bounds before doing any work, so a malformed or truncated input does not reach an unchecked pointer dereference.

Layer 2: Overflow-safe arithmetic: section offset calculations use s->size > bin->size - s->offset (subtraction form) rather than s->offset + s->size > bin->size (addition form), so integer overflow cannot turn an out-of-bounds section into one that passes the check. ELF sh_name indices are checked against the string table size before pointer arithmetic.

Layer 3: Pass isolation (DAX_RUN_PASS): each of the 32 analysis passes in main.c runs independently. If a pass sets g_dax_fault, the program reports the fault and continues to the next pass, so a single corrupt function or section does not abort the whole analysis run.

These layers reduce, but do not eliminate, memory-safety risk from adversarial input. A report that demonstrates a bypass: an actual crash, memory corruption, or code execution: is treated as a high-severity finding regardless of which layer it goes through.

Reporting a Vulnerability#

Do not open a public GitHub issue for security vulnerabilities.

Preferred: GitHub Security Advisories: a private channel scoped to this repository.

Alternative: open a blank issue titled [SECURITY] Private report request. We aim to respond within 48 hours with a secure channel for details.

What to include#

Description and potential impact
Steps to reproduce (minimal command or crafted file)
Proof-of-concept (crafted binary or command sequence), if you have one
Whether the fault isolation layer (dax_guard.h) was bypassed or triggered
Environment details (OS, architecture, Rerius version, compiler)
Suggested fix, if you have one

Response Timeline#

These are targets, not guarantees; actual response time can vary with severity and maintainer availability.

Milestone	Target
Acknowledgement	48 hours
Severity assessment	7 days
Fix for critical issues	30 days
Fix for moderate issues	90 days
Public advisory	7 days after fix ships

Reporters are credited in the advisory and changelog unless anonymity is requested.

Safe Use#

The REST server (js/server/server.js) accepts a file path in the POST body and is designed for local or LAN use. Do not expose it to the public internet without adding your own authentication and access controls.
The emulator (-I) executes ARM64 and RISC-V instructions against an in-process, sandboxed memory model; it does not touch host memory or host syscalls outside that model.
The entropy, recursive-descent (RDA), and IVF modules only read binary data: they do not modify the input file.
The fault isolation layer (dax_guard.h) is a robustness mechanism for recovering from corrupt inputs, not a security sandbox. It should not be relied on to stop a determined attacker from crashing the process.
When analyzing samples from untrusted sources, run Rerius inside a container, VM, or similar isolated environment: the same precaution you'd take with any tool that parses attacker-controlled files.

Disclosure Policy#

Rerius follows coordinated disclosure: the reporter shares details privately, a fix is developed and released, and a public advisory follows roughly 7 days after the fix ships. We ask reporters to hold off on public disclosure until then.