Bug 914070 (CVE-2023-4039)

Summary:	sys-devel/gcc: Stack protection and stack clash protection ineffective for VLAs on arm64 (-fstack-protector* and -fstack-clash-protection)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	arm64, toolchain
Priority:	Normal
Version:	unspecified
Hardware:	ARM64
OS:	Linux
URL:	https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64
See Also:	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111411
Whiteboard:	B3 [upstream]
Package list:		Runtime testing required:	---

Description Sam James archtester

2023-09-12 23:10:19 UTC

* https://mastodon.social/@Azeria/111053168811826637
* https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64
* https://inbox.sourceware.org/gcc-patches/46cfa37b-56eb-344d-0745-e0d35393392d@gotplt.org/T/#m93e8e96a10669618da4e4d82c161fbc74653f7d0

"""
GCC's stack protection feature (enabled with the flag -fstack-protector) aims to detect buffer overflows in C/C++ function local variables that might allow an attacker to overwrite saved registers on the stack. If an attacker can modify saved register values then it might be possible for them to subvert program flow control. The feature operates by placing a canary value between local variables and saved registers on the stack on function entry, and triggers an error handler on function exit if the canary value has been unexpectedly modified.

When targeting AArch64, this feature did not protect the saved registers from overflows in C99-style dynamically-sized local variables and alloca() objects. Other local variables, including statically-sized local arrays, are not affected because of their different placement on the stack relative to saved registers. Further technical details of this issue can be found at Meta Red Team GitHub.

Arm has also examined GCC targeting AArch32 and clang targeting AArch32 and AArch64 and believes none of these are affected by this issue.
"""

Comment 1 Sam James archtester

2023-09-12 23:10:39 UTC

This isn't yet in any snapshots.

Comment 2 Sam James archtester

2023-09-12 23:12:53 UTC

* https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf

Comment 3 Sam James archtester

2023-09-18 10:28:28 UTC

The patches need work, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111411.

Comment 4 Larry the Git Cow gentoo-dev

2023-10-15 15:53:36 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=62544765c5b0fdd996522ac756afbc8e9ac2c703

commit 62544765c5b0fdd996522ac756afbc8e9ac2c703
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-10-15 15:52:53 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-10-15 15:52:58 +0000

    sys-devel/gcc: keyword 13.2.1_p20231014
    
    Closes: https://bugs.gentoo.org/912035
    Bug: https://bugs.gentoo.org/914070
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-devel/gcc/gcc-13.2.1_p20231014.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)