OESA-2023-1735

Dashboard / Vulnerabilities / OESA-2023-1735

OESA-2023-1735

Summary: gcc security update

Details: The gcc package contains the GNU Compiler Collection version 10. You'll need this package in order to compile C code. Security Fix(es): A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. (CVE-2023-4039)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1735, https://nvd.nist.gov/vuln/detail/CVE-2023-4039