CVE-2023-4039 GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

What is CVE-2023-4039?

CVE-2023-4039 is a medium-severity vulnerability in Arm GNU Toolchain, published on 13 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.

The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Weakness: CWE-693

Which versions are affected by CVE-2023-4039?

It affects 1 product.

Products include Gnu Gcc.

How do I fix CVE-2023-4039?

Apply the vendor's patch.

Is CVE-2023-4039 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4039 exists.

Other vulnerabilities in Arm GNU Toolchain

• CVE-2018-12886 Security feature bypass in n/a High 8.1
• CVE-2002-2439 Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts. High 7.8
• CVE-2019-15847 Weak cryptography in n/a High 7.5
• CVE-2008-1367 Memory corruption in n/a High 7.5
• CVE-2008-1685 Integer overflow in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as ALPINE-CVE-2023-4039, AZL-28769, AZL-34695, DEBIAN-CVE-2023-4039, ECHO-4f67-4add-cfdb, MINI-8q24-vc8f-v8x5 and 14 more.