CVE-2023-4039

Public on 2023-09-12
Modified on 2024-01-30
Description
An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature (-fstack-protector) did not detect or defend against overflows of dynamically-sized local variables. This update to the GCC compiler remedies code generation for this defense in depth feature, ensuring it is working as intended.

Customers building their own binaries with GCC are advised to update their compiler, and to ensure they are enabling the defense in depth options available to them, such as the stack protector.
Severity
Medium severity
Medium
CVSS v3 Base Score
4.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 gcc Not Affected
Amazon Linux 2 - Core gcc 2023-09-08 ALAS2-2023-2245 Fixed
Amazon Linux 2023 gcc 2023-09-08 ALAS2023-2023-342 Fixed
Amazon Linux 2 - Core gcc10 2023-09-08 ALAS2-2023-2244 Fixed
Amazon Linux 1 gcc48 Not Affected
Amazon Linux 1 gcc64 Not Affected
Amazon Linux 1 gcc72 Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD CVSSv3 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N