Intel MKL does not enable the control flow guard (CFG)

[gatendol]

Hi,

I am using Intel MKL via nuget package. Our software release pipelines use BinSkim, a tool which validates compiler/linker settings and other security-relevant binary characteristics. When this task runs on intel MKL DLLs, it throws errors –

mkl_avx.dll: error *****: 'mkl_avx.dll' does not enable the control flow guard (CFG) mitigation. To resolve this issue, pass /guard:cf on both the compiler and linker command lines. Binaries also require the /DYNAMICBASE linker option in order to enable CFG.

and some others like below

mkl_avx.dll : error *****.ExceptionLoadingPdb : ***** : 'mkl_avx.dll' was not evaluated for check 'DoNotIncorporateVulnerableDependencies' because its PDB could not be loaded. (E_PDB_NO_DEBUG_INFO (Pdb is stripped of cv (CodeView) info))

We cannot ship products with MKL due to this issue. Is there a nuget package that enables CFG?

[Gennady_F_Intel]

Gaurav, there is no such package available at this moment but we already saw a similar request and probably will add such option into a future version of Intel MKL. This thread would be updated in the case of any news.