CVE-2023-4039
Public on 2023-09-12
Modified on 2024-01-30
Description
An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature (-fstack-protector) did not detect or defend against overflows of dynamically-sized local variables. This update to the GCC compiler remedies code generation for this defense in depth feature, ensuring it is working as intended.
Customers building their own binaries with GCC are advised to update their compiler, and to ensure they are enabling the defense in depth options available to them, such as the stack protector.
Customers building their own binaries with GCC are advised to update their compiler, and to ensure they are enabling the defense in depth options available to them, such as the stack protector.
Severity
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 1 | gcc | Not Affected | ||
Amazon Linux 2 - Core | gcc | 2023-09-08 | ALAS2-2023-2245 | Fixed |
Amazon Linux 2023 | gcc | 2023-09-08 | ALAS2023-2023-342 | Fixed |
Amazon Linux 2 - Core | gcc10 | 2023-09-08 | ALAS2-2023-2244 | Fixed |
Amazon Linux 1 | gcc48 | Not Affected | ||
Amazon Linux 1 | gcc64 | Not Affected | ||
Amazon Linux 1 | gcc72 | Not Affected |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
NVD | CVSSv3 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |