PT-2019-6329 · Gnu+1 · Gnu Compiler Collection+1
Published
2019-03-07
·
Updated
2020-08-24
·
CVE-2018-12886
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU Compiler Collection (GCC) versions 4.1 through 8
Description
The issue is related to the
stack protect prologue in cfgexpand.c and stack protect epilogue in function.c functions in GNU Compiler Collection (GCC). When targeting ARM targets, these functions can generate instruction sequences that spill the address of the stack protector guard, allowing an attacker to bypass the protection of stack overflow mitigations. This could potentially impact the confidentiality, integrity, and availability of protected information.Recommendations
For GNU Compiler Collection (GCC) versions 4.1 through 8, consider disabling the
stack protect prologue and stack protect epilogue functions as a temporary workaround until a patch is available. Restrict access to the affected ARM targets to minimize the risk of exploitation. Avoid using the stack protector guard in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Gnu Compiler Collection