CVE-2023-4039: gcc-12-base -fstack-protector fails to guard dynamic stack allocations on ARM64
Summary
CVE-2023-4039: DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without th... Affects gcc versions < 13.2.1_git20231014-r0. Fixed in 13.2.1_git20231014-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gcc-12-base is a package that provides the base runtime library for the GNU Compiler Collection (GCC) version 12.2.0-14. It is used to compile and run C and C++ programs. The package is vulnerable to a specific issue related to the -fstack-protector feature when targeting AArch64 architecture. This vulnerability allows an attacker to exploit buffer overflows in dynamically-sized local variables without detection. It primarily affects C99-style dynamically-sized local variables or those created using alloca(). Statically-sized local variables are not affected by this vulnerability.
Vulnerability Detail
The -fstack-protector feature in GCC-based toolchains targeting AArch64 architecture has a failure that allows an attacker to exploit buffer overflows in dynamically-sized local variables without detection. This vulnerability can be leveraged to cause a controlled loss of availability or potentially affect confidentiality and integrity. The stack-protector feature is designed to terminate the application upon detecting an overflow, but this failure allows the attacker to bypass it. The GCC project argues that this is a missed hardening bug rather than a vulnerability in itself.
How To Fix
Minimum fixed version
13.2.1_git20231014-r0
This is the first release that contains the fix.
sudo apk add --upgrade gccTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider implementing additional security measures such as input validation and proper bounds checking in their applications to minimize the risk of buffer overflows.
Conclusion
The gcc-12-base package is vulnerable to a failure in the -fstack-protector feature when targeting AArch64 architecture. This vulnerability allows an attacker to exploit buffer overflows in dynamically-sized local variables without detection. It is recommended to update the package to a fixed version once it becomes available. Regularly updating systems and applying security patches is crucial to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gcc →
FAQ
gcc-12-base is the base runtime library for the GNU Compiler Collection (GCC) version 12.2.0-14. It is used to compile and run C and C++ programs.
The vulnerability affects gcc-12-base version 12.2.0-14.
The vulnerability allows an attacker to exploit buffer overflows in dynamically-sized local variables without detection. It can lead to a controlled loss of availability and potentially affect confidentiality and integrity.
A fix for this vulnerability is expected to be released by the package maintainers. It is recommended to update to the latest version of gcc-12-base once the fix is available.
No, statically-sized local variables are not affected by this vulnerability. The vulnerability primarily affects C99-style dynamically-sized local variables or those created using alloca().
Related vulnerabilities
Recent vulnerabilities recorded for gcc.
