PT-2008-2957 · Gnu+1 · Gcc+1

Aurélien Jarno

+2

·

Publicado

2008-03-17

·

Atualizado

2017-09-29

·

CVE-2008-1367

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions gcc versions 4.3.x
Description The issue concerns the generation of a cld instruction while compiling functions used for string manipulation, such as memcpy and memmove, on x86 and i386 architectures. This can prevent the direction flag (DF) from being reset, violating ABI conventions, and potentially cause data to be copied in the wrong direction during signal handling in the Linux kernel. This might allow attackers to trigger memory corruption.
Recommendations For gcc version 4.3.x, consider updating the compiler to a version that correctly generates the cld instruction for string manipulation functions to prevent potential memory corruption issues.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-1367
RHSA-2008:0211
RHSA-2008:0233
RHSA-2008:0508
RHSA-2008_0233
RHSA-2008_0508

Produtos afetados

Red Hat
Gcc