Bug 836239 – <sys-devel/gcc-13.0.0_pre20220710: stack overflow in libiberty rust-demangle

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2022-03-27 01:01:54 UTC]

CVE-2022-27943:

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Proposed patch: https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html

[Comment 1 Andreas K. Hüttel 2022-04-25 22:28:18 UTC]

(In reply to John Helmert III from comment #0)
> CVE-2022-27943:
> 
> libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in
> demangle_const, as demonstrated by nm-new.
> 
> Proposed patch:
> https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html

This needs to be handled upstream first.

[Comment 2 John Helmert III 2022-08-14 19:35:16 UTC]

Looks like this is committed upstream as 9234cdca6ee88badfc00297e72f13dac4e540c79 but in no releases.

[Comment 3 John Helmert III 2023-10-07 19:00:14 UTC]

Looks like this is only in releases 13.1 and beyond, but also in our snapshot gcc-13.0.0_pre20220710 and beyond.

 ~/git/gcc $ git tag --contains 9234cdca6ee88badfc00297e72f13dac4e540c79
basepoints/gcc-14
releases/gcc-13.1.0
releases/gcc-13.2.0
 ~/git/gcc $ git log --all --grep "Add a recursion limit to the demangle_const function in the Rust demangler."
commit 9234cdca6ee88badfc00297e72f13dac4e540c79
Author: Nick Clifton <[e-mail]>
Date:   Fri Jul 1 15:58:52 2022 +0100

    Add a recursion limit to the demangle_const function in the Rust demangler.

    libiberty/
            PR demangler/105039
            * rust-demangle.c (demangle_const): Add recursion limit.

[Comment 4 Sam James 2024-07-11 17:07:05 UTC]

libiberty is a bundled library in GCC, binutils, gdb and it's only exposed in some narrow ways. I don't think this is exploitable at all, hence A->C.