CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-4039 – GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64
https://notcve.org/view.php?id=CVE-2023-4039
**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself. • https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf • CWE-693: Protection Mechanism Failure •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37322
https://notcve.org/view.php?id=CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. Se ha detectado que GCC c++filt versión v2.26 contiene una vulnerabilidad de uso de memoria previamente liberada por medio del componente cplus-dem.c. • https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99188 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15847 – gcc: POWER9 "DARN" RNG intrinsic produces repeated output
https://notcve.org/view.php?id=CVE-2019-15847
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same. El backend POWER9 en GNU Compiler Collection (GCC) en versiones anteriores a la 10 podría optimizar múltiples llamadas de __builtin_darn intrínsecas en una sola llamada, reduciendo así la entropía del generador de números aleatorios. Esto ocurrió porque no se especificó una operación volátil. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 https://access.redhat.com/security/cve/CVE-2019-15847 https://bugzilla.redhat.com/show_bug.cgi?id=1755523 • CWE-331: Insufficient Entropy •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12886
https://notcve.org/view.php?id=CVE-2018-12886
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against. stack_protect_prologue en cfgexpand.c y stack_protect_epilogue en function.c en GNU Compiler Collection (GCC) 4.1 a 8 (bajo ciertas circunstancias) genera secuencias de instrucciones al apuntar a objetivos ARM que derraman la dirección del protector de pila, que permite al atacante eludir el la protección de -fstack-protector, -fstack-protector-all, -fstack-protector-strong y -fstack-protector-explicit contra el desbordamiento de pila controlando contra qué se compara la pila Canary. • https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup https://www.gnu.org/software/gcc/gcc-8/changes.html • CWE-209: Generation of Error Message Containing Sensitive Information •