CVE-2023-4039

/// Technical description

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains

that target AArch64 allows an attacker to exploit an existing buffer

overflow in dynamically-sized local variables in your application

without this being detected. This stack-protector failure only applies

to C99-style dynamically-sized local variables or those created using

alloca(). The stack-protector operates as intended for statically-sized

local variables.

The default behavior when the stack-protector

detects an overflow is to terminate your application, resulting in

controlled loss of availability. An attacker who can exploit a buffer

overflow without triggering the stack-protector might be able to change

program flow control to cause an uncontrolled loss of availability or to

go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References