Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2022-27943

Published: 26 March 2022

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Notes

AuthorNote
sbeattie
gcc-3.3 only provides libstdc++5
litios
affected code introduced in gcc-11.1.0 on 2020-11-13 with 84096498a7b ("libiberty: Support the new ("v0") mangling scheme in rust-demangle")
litios
affected code introduced in binutils in d750c713
eslerm
fixed in gcc-13.1.0 on 2022-07-01 with 9234cdca6ee ("Add a recursion limit to the demangle_const function in the fixed in binutils-2_39 on 2020-01-31 with f10f8617a30 ("Import patch from mainline GCC to fix an infinite recusion in the Rust demangler.")

Priority

Low

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package Release Status
gcc-10
Launchpad, Ubuntu, Debian
kinetic Not vulnerable
(code not present)
trusty Does not exist

xenial Does not exist

bionic Does not exist

focal Not vulnerable
(code not present)
impish Ignored
(end of life)
lunar Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
jammy Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
gcc-4.7-armel-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

jammy Does not exist

mantic Does not exist

gcc-4.7-armhf-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

jammy Does not exist

mantic Does not exist

gcc-4.8-arm64-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

jammy Does not exist

xenial Needs triage

mantic Does not exist

Binaries built from this source package are in Universe and so are supported by the community.
gcc-4.8-armhf-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

jammy Does not exist

xenial Needs triage

mantic Does not exist

Binaries built from this source package are in Universe and so are supported by the community.
gcc-4.8-powerpc-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

jammy Does not exist

xenial Needs triage

mantic Does not exist

Binaries built from this source package are in Universe and so are supported by the community.
gcc-4.8-ppc64el-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

upstream Needs triage

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

jammy Does not exist

xenial Needs triage

mantic Does not exist

Binaries built from this source package are in Universe and so are supported by the community.
gcc-5-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

trusty Does not exist

upstream Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

lunar Does not exist

jammy Does not exist

bionic Not vulnerable
(code not present)
xenial Not vulnerable
(code not present)
mantic Does not exist

gcc-6-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

focal Does not exist

impish Does not exist

upstream Not vulnerable
(code not present)
lunar Does not exist

trusty Does not exist

xenial Does not exist

jammy Does not exist

bionic Not vulnerable
(code not present)
mantic Does not exist

gcc-6-cross-ports
Launchpad, Ubuntu, Debian
kinetic Does not exist

impish Does not exist

upstream Not vulnerable
(code not present)
focal Does not exist

lunar Does not exist

trusty Does not exist

xenial Does not exist

jammy Does not exist

bionic Not vulnerable
(code not present)
mantic Does not exist

gcc-7-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

upstream Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

trusty Does not exist

xenial Does not exist

lunar Does not exist

jammy Does not exist

bionic Needs triage

mantic Does not exist

gcc-7-cross-ports
Launchpad, Ubuntu, Debian
kinetic Does not exist

focal Does not exist

impish Does not exist

trusty Does not exist

upstream Not vulnerable
(code not present)
lunar Does not exist

xenial Does not exist

jammy Does not exist

bionic Needs triage

mantic Does not exist

gcc-8
Launchpad, Ubuntu, Debian
kinetic Does not exist

impish Ignored
(end of life)
trusty Does not exist

xenial Does not exist

bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-8-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

impish Does not exist

upstream Not vulnerable
(code not present)
lunar Does not exist

trusty Does not exist

xenial Does not exist

jammy Does not exist

bionic Needs triage

focal Needs triage

mantic Does not exist

gcc-8-cross-ports
Launchpad, Ubuntu, Debian
kinetic Does not exist

impish Does not exist

xenial Does not exist

upstream Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
lunar Does not exist

trusty Does not exist

jammy Does not exist

bionic Not vulnerable
(code not present)
mantic Does not exist

gcc-arm-linux-androideabi
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

trusty Does not exist

upstream Needs triage

lunar Does not exist

jammy Does not exist

xenial Needs triage

mantic Does not exist

gcc-defaults-arm64-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

jammy Does not exist

mantic Does not exist

gcc-defaults-armel-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

impish Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

jammy Does not exist

mantic Does not exist

gcc-defaults-armhf-cross
Launchpad, Ubuntu, Debian
kinetic Does not exist

focal Does not exist

impish Does not exist

bionic Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

jammy Does not exist

mantic Does not exist

gcc-i686-linux-android
Launchpad, Ubuntu, Debian
kinetic Does not exist

bionic Does not exist

focal Does not exist

trusty Does not exist

impish Does not exist

jammy Does not exist

lunar Does not exist

upstream Needs triage

xenial Needs triage

mantic Does not exist

gcc-3.3
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(code not present)
bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
impish Not vulnerable
(code not present)
kinetic Ignored
(end of life, was needs-triage)
lunar Not vulnerable
(code not present)
xenial Needs triage

jammy Not vulnerable
(code not present)
trusty Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
gcc-4.4
Launchpad, Ubuntu, Debian
focal Does not exist

impish Does not exist

upstream Not vulnerable
(code not present)
bionic Does not exist

kinetic Does not exist

lunar Does not exist

trusty Does not exist

xenial Does not exist

jammy Does not exist

mantic Does not exist

gcc-4.6
Launchpad, Ubuntu, Debian
trusty Does not exist

xenial Does not exist

upstream Not vulnerable
(code not present)
bionic Does not exist

focal Does not exist

impish Does not exist

kinetic Does not exist

lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-4.7
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(code not present)
bionic Does not exist

focal Does not exist

impish Does not exist

trusty Not vulnerable
(code not present)
xenial Needs triage

kinetic Does not exist

lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-4.8
Launchpad, Ubuntu, Debian
xenial Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

kinetic Does not exist

lunar Does not exist

jammy Does not exist

bionic Not vulnerable
(code not present)
trusty Not vulnerable
(code not present)
mantic Does not exist

gcc-4.9
Launchpad, Ubuntu, Debian
bionic Does not exist

trusty Does not exist

upstream Not vulnerable
(code not present)
xenial Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

kinetic Does not exist

lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-5
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not present)
xenial Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

trusty Does not exist

upstream Not vulnerable
(code not present)
kinetic Does not exist

lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-6
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not present)
focal Does not exist

impish Does not exist

trusty Does not exist

xenial Does not exist

upstream Not vulnerable
(code not present)
kinetic Does not exist

lunar Does not exist

jammy Does not exist

mantic Does not exist

gcc-7
Launchpad, Ubuntu, Debian
trusty Does not exist

focal Not vulnerable
(code not present)
impish Does not exist

bionic Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
lunar Does not exist

xenial Does not exist

jammy Does not exist

kinetic Does not exist

mantic Does not exist

gcc-9
Launchpad, Ubuntu, Debian
bionic Does not exist

trusty Does not exist

xenial Does not exist

focal Not vulnerable
(code not present)
jammy Not vulnerable
(code not present)
kinetic Not vulnerable
(code not present)
lunar Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
impish Ignored
(end of life)
mantic Not vulnerable
(code not present)
gcc-11
Launchpad, Ubuntu, Debian
bionic Does not exist

xenial Does not exist

focal Does not exist

upstream Needs triage

impish Ignored
(end of life)
kinetic Ignored
(end of life, was needed)
jammy Needed

lunar Ignored
(end of life, was needed)
trusty Does not exist

mantic Needed

gcc-9-cross
Launchpad, Ubuntu, Debian
trusty Does not exist

xenial Does not exist

kinetic Ignored
(end of life, was needs-triage)
jammy Not vulnerable
(code not present)
bionic Does not exist

lunar Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
impish Ignored
(end of life)
focal Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
gcc-9-cross-ports
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(code not present)
impish Ignored
(end of life)
kinetic Ignored
(end of life, was needs-triage)
focal Not vulnerable
(code not present)
jammy Not vulnerable
(code not present)
lunar Not vulnerable
(code not present)
bionic Does not exist

trusty Does not exist

xenial Does not exist

mantic Not vulnerable
(code not present)
gcc-snapshot
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not present)
focal Ignored
(end of standard support, was needs-triage)
trusty Does not exist

upstream Needs triage

kinetic Ignored
(end of life, was needs-triage)
jammy Ignored
(end of standard support, was needs-triage)
lunar Not vulnerable
(code not present)
impish Ignored
(end of life)
xenial Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
gcc-arm-none-eabi
Launchpad, Ubuntu, Debian
upstream Needs triage

kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
lunar Ignored
(end of life, was needs-triage)
trusty Does not exist

jammy Needs triage

xenial Needs triage

mantic Needs triage

gcc-avr
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
trusty Does not exist

upstream Needs triage

xenial Needs triage

mantic Needs triage

gcc-defaults
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
lunar Ignored
(end of life, was needs-triage)
trusty Needs triage

upstream Needs triage

xenial Needs triage

jammy Needs triage

mantic Needs triage

crash
Launchpad, Ubuntu, Debian
trusty Ignored
(end of standard support)
xenial Not vulnerable
(code not present)
bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
jammy Not vulnerable
(code not present)
lunar Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
gdb
Launchpad, Ubuntu, Debian
trusty Ignored
(end of standard support)
xenial Not vulnerable
(code not present)
bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
jammy Needed

lunar Not vulnerable
(13.1-2ubuntu2)
upstream
Released (12.1-3ubuntu2)
mantic Not vulnerable
(13.2-1ubuntu1)
gcc-12
Launchpad, Ubuntu, Debian
trusty Does not exist

xenial Does not exist

bionic Does not exist

focal Does not exist

jammy Needed

lunar Ignored
(end of life, was needed)
upstream Needs triage

mantic Needed

gcc-13
Launchpad, Ubuntu, Debian
trusty Does not exist

xenial Does not exist

bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Not vulnerable
(13.2.0-2)
upstream Not vulnerable
(13.2.0-2)
mantic Not vulnerable
(13.2.0-2)
binutils
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
jammy Needed

kinetic Not vulnerable
(2.39-1)
lunar Not vulnerable
(2.39-1)
trusty Not vulnerable
(code not present)
upstream Not vulnerable
(2.39)
xenial Not vulnerable
(code not present)
mantic Not vulnerable
(2.39-1)
gcc-defaults-powerpc-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

mantic Does not exist

gcc-defaults-ppc64el-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

mantic Does not exist

gcc-h8300-hms
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
trusty Does not exist

upstream Needs triage

xenial Needs triage

mantic Needs triage

gcc-m68hc1x
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

mantic Does not exist

gcc-mingw-w64
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
trusty Needs triage

upstream Needs triage

xenial Needs triage

mantic Needs triage

gcc-msp430
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

kinetic Ignored
(end of life, was needs-triage)
lunar Ignored
(end of life, was needs-triage)
trusty Does not exist

upstream Needs triage

xenial Needs triage

mantic Needs triage

gcc-opt
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needs-triage)
bionic Needs triage

focal Needs triage

impish Ignored
(end of life)
jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
trusty Does not exist

upstream Needs triage

xenial Needs triage

mantic Needs triage

gccgo-4.9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

upstream Needs triage

xenial Does not exist

trusty Not vulnerable
(code not present)
mantic Does not exist

gccgo-6
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code not present)
mantic Does not exist

libiberty
Launchpad, Ubuntu, Debian
upstream Needs triage

xenial Not vulnerable
(code not present)
bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
hirsute Ignored
(end of life)
jammy Needed

kinetic Not vulnerable
(20220713-1)
lunar Not vulnerable
(20230104-1)
trusty Does not exist

mantic Not vulnerable
(20230104-1)
Patches:
upstream: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79

Severity score breakdown

Parameter Value
Base score 5.5
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H