AD3042: DoNotStaticallyLinkOpenSSLELF¶

Summary¶

Description¶

ELF binaries should not statically link OpenSSL. Static linking makes it difficult to update OpenSSL when security vulnerabilities are discovered.

How It Works¶

The rule detects statically linked OpenSSL by:

1. Scanning for OpenSSL version strings
2. Checking for OpenSSL symbols without dynamic references
3. Detecting libcrypto/libssl code patterns

Why This Matters¶

OpenSSL vulnerabilities are frequently discovered and require prompt patching. Static linking prevents quick updates.

OpenSSL Vulnerability History¶

Update Scenarios¶

Vulnerability Disclosed:

Static linking path:
  Identify affected binaries
  → Rebuild each one
  → Test each one
  → Deploy each one
  → Days to weeks

Dynamic linking path:
  Update system OpenSSL package
  → Restart services
  → Hours

Detection Method¶

Static OpenSSL indicators:
  - No libssl.so/libcrypto.so in DT_NEEDED
  - OpenSSL version string embedded
  - SSL_* symbols not in dynamic section

Container Considerations¶

Exceptions¶

Resolution¶

Use dynamic linking:

# Dynamic linking (default)
gcc -o program program.c -lssl -lcrypto

# Verify dynamic linking
ldd program | grep -E 'libssl|libcrypto'

CMake Configuration¶

find_package(OpenSSL REQUIRED)
target_link_libraries(myapp OpenSSL::SSL OpenSSL::Crypto)
# Do not use OPENSSL_USE_STATIC_LIBS