Cygwin DLL mismatch on Mandatory ASLR enabled systems

[SakuraIsayeki]

Context

Some W11 systems are configured to use more extensive security features, either by user choice or company policy.
One of these more problematic features is ASLR, which has the nasty side effect of breaking heaps of software, due to address relocations.

Problem

On a W11 system with Mandatory ASLR enabled (configured via Windows security), SSHFS-Win's underlying Cygwin implementation will throw a fatal error, citing address mismatch. This causes in most cases the network mapping to silently fail without errors.
Diagnosing this fault can be done by running .\sshfs-win.exe svc \sshfs.kr\user@myserver\ X:.

Reproduction

The issue can be systematically reproduced by toggling "Force randomisation for images (Mandatory ASLR)" in Windows Security to "On by default" :

Workaround

Disabling Mandatory ASLR and rebooting will solve any issues caused by address mismatch.

While this issue may perhaps never be fixed in the scope of SSHFS-Win, I ought to share my findings, having spent way too much time diagnosing this issue.

[billziss-gh]

@SakuraIsayeki this is very helpful to know. Thank you!

[ronhombre]

This issue just happened to me. I hadn't connected to an SFTP server for a while so I didn't notice immediately when I enabled Mandatory ASLR. (I had to enable it because I'm suspecting I have some sort of malware)

[ronhombre]

I found a solution through trial and error.

Windows Defender -> App & Browser control -> Exploit protection settings -> Program settings -> Add program to customize -> Choose exact file path -> C:\Program Files\SSHFS-Win\bin\ssh.exe -> Forced randomization for images (Mandatory ASLR) -> Override system settings -> Off

Windows Defender -> App & Browser control -> Exploit protection settings -> Program settings -> Add program to customize -> Choose exact file path -> C:\Program Files\SSHFS-Win\bin\sshfs.exe -> Forced randomization for images (Mandatory ASLR) -> Override system settings -> Off

Essentially, we're disabling Mandatory ASLR for ssh.exe and sshfs.exe. I recommend setting the exceptions through the exact file path in order to minimize the attack surface.

Also, I recommend that this exception be added for SSHFS-Win during installation to encourage users to keep Mandatory ASLR ON by default