DCL warning

rbb

Hello,
I've attempted to install an app and received a warning regarding DCL by memory. Are there legitimate reasons why an app would need/use DCL? This is the first I've seen it arise.

de0u

rbb Are there legitimate reasons why an app would need/use DCL?

This is common for JITs, e.g., browser JavaScript engines. I wouldn't be surprised if some game engines do it.

The reason for the warning is that perhaps the app is not deliberately doing it, but is being exploited.

GrapheneOS

rbb This is because you disabled dynamic code loading by default. The default permits it for compatibility.

de0u The notification is shown when users disallow it for an app and the app uses it. It's allowed by default.

dasaint100

Would the below show that there is an exploit for WhatsApp:

type: storage_DCL
osVersion: google/shiba/shiba:15/AP4A.241205.013/2024123000:user/release-keys
userType: full.secondary
package: com.whatsapp:242***021, targetSdk 34

package: com.whatsapp:242***021

DCL denial type: DENY_EXECUTE_APP_DATA_FILE
thread: com.whatsapp
targetPath: /data/user/12/com.whatsapp/files/decompressed/libs.spo/libc++_shared.so

DeletedUser88

dasaint100 I get the same error. WhatsApp just requires DCL via storage to function. It ideally shouldn't but it is what it is.

GrapheneOS

dasaint100 No, it's not a sign of an exploit. In this case, it's showing that the app is poorly written in regards to handling native libraries. The app is extracting them to their app data where the app or an attacker who exploits the app either via a file write vulnerability or code execution vulnerability can write to them. They should be including the libraries properly in their APK and either loading them directly from the APK (ideal) or having the OS extract them and loading them from there. APKs are compressed in transit. What they're doing is the worst of all worlds: worst security, high disk space usage, most complexity for their code, etc. The only advantage of what they're doing is that their APK is smaller because they used something like zstd to compress the libraries inside it but the installed size of the app on disk is larger since it has both the zstd compressed libraries + decompressed libraries instead of only decompressed libraries in the APK. The transfer size isn't necessarily smaller either. They're just doing something bad probably because Facebook wants to use zstd as much as they can.

rbb

Are certain types of apps more prone to triggering a DCL warning? ie financial apps, etc

GrapheneOS

rbb Dynamic code loading from storage is almost always a sign of a poorly written app with an unnecessary security weakness. Dynamic code loading from memory generally means they're using a programming language based around just-in-time compilation for performance but in rare cases it's simply because of negligence.

DeletedUser125 It will almost always break functionality of the app, otherwise they wouldn't be trying to do it.

DeletedUser125

I wonder if we can just ignore if the app doesn't crash and apparently functions as it should.

de0u

DeletedUser125 Crashing is a sign of an innocent bug, or of an exploit with rough edges. A lack of crashing is a sign of the app running fine, or else being successfully exploited by a skilled actor.

Thus crashing does not mean exploited, and non-crashing does not mean non-exploited.