PT-2019-6329 · Gnu+1 · Gnu Compiler Collection+1
Publicado
2019-03-07
·
Atualizado
2020-08-24
·
CVE-2018-12886
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU Compiler Collection (GCC) versions 4.1 through 8
Description
The issue is related to the
stack protect prologue in cfgexpand.c and stack protect epilogue in function.c functions in GNU Compiler Collection (GCC). When targeting ARM targets, these functions can generate instruction sequences that spill the address of the stack protector guard, allowing an attacker to bypass the protection of stack overflow mitigations. This could potentially impact the confidentiality, integrity, and availability of protected information.Recommendations
For GNU Compiler Collection (GCC) versions 4.1 through 8, consider disabling the
stack protect prologue and stack protect epilogue functions as a temporary workaround until a patch is available. Restrict access to the affected ARM targets to minimize the risk of exploitation. Avoid using the stack protector guard in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Generation of Error Message Containing Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Gnu Compiler Collection