Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2023-4039

Published: 12 September 2023

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Notes

AuthorNote
sbeattie
gcc-3.3 only provides libstdc++5
alexmurray
patches are expected to be provided for upstream versions 11, 12,
13 and trunk
Any possible package on arm64 in Ubuntu could be affected by this
and would therefore need to be recompiled by a new version of gcc containing
this fix - however, performing a whole-of-archive rebuild is not feasible. It
might be possible to detect which packages need to be rebuilt by looking for
those with the -fstack-clash-protection mitigation via hardening-check (as
since Ubuntu 20.04 LTS nearly all packages are compiled with this by
default). This is still likely to be quite a large subset of the archive and
still not feasible to rebuild. Instead as regular security / SRU updates are
performed for packages, they will opportunistically receive this fix.
sbeattie
14.04 LTS (trusty) Pro Infra and 16.04 LTS (xenial) Pro Infra
do not support Arm64 as an architecture.

Priority

Medium

Cvss 3 Severity Score

4.8

Score breakdown

Status

Package Release Status
gcc-10
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needed

noble Pending
(10.5.0-3ubuntu1)
trusty Does not exist

upstream
Released (10.5.0-3)
xenial Does not exist

gcc-10-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-10-cross-mipsen
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-10-cross-ports
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-11
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic
Released (11.4.0-4ubuntu1)
noble
Released (11.4.0-4ubuntu1)
trusty Does not exist

upstream
Released (11.4.0-4)
xenial Does not exist

gcc-11-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-11-cross-mipsen
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-11-cross-ports
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-12
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic
Released (12.3.0-9ubuntu1)
noble
Released (12.3.0-9ubuntu1)
trusty Does not exist

upstream
Released (12.3.0-9)
xenial Does not exist

gcc-12-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-12-cross-mipsen
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-12-cross-ports
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-13
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Ignored
(end of life, was needs-triage)
mantic
Released (13.2.0-4ubuntu1)
noble
Released (13.2.0-4ubuntu1)
trusty Does not exist

upstream
Released (13.2.0-4)
xenial Does not exist

gcc-13-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-13-cross-ports
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-3.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(only provides libstdc++5 on amd64, i386)
focal Not vulnerable
(only provides libstdc++5 on amd64, i386)
jammy Not vulnerable
(only provides libstdc++5 on amd64, i386)
lunar Not vulnerable
(only provides libstdc++5 on amd64, i386)
mantic Not vulnerable
(only provides libstdc++5 on amd64, i386)
noble Not vulnerable
(only provides libstdc++5 on amd64, i386)
trusty Not vulnerable
(only provides libstdc++5 on amd64, i386)
upstream Needs triage

xenial Not vulnerable
(only provides libstdc++5 on amd64, i386)
gcc-4.4
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-4.6
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-4.7
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(ESM criteria, Arm64 not supported)
upstream Needs triage

xenial Ignored
(ESM criteria, Arm64 not supported)
gcc-4.7-armel-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.7-armhf-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.8
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(ESM criteria, Arm64 not supported)
upstream Needs triage

xenial Ignored
(ESM criteria, Arm64 not supported)
gcc-4.8-arm64-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.8-armhf-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.8-powerpc-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.8-ppc64el-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-4.9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(ESM criteria, Arm64 not supported)
gcc-4.9-cross
Launchpad, Ubuntu, Debian
bionic Ignored
(end of standard support)
focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

gcc-5
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(ESM criteria, Arm64 not supported)
gcc-5-cross
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

gcc-5-cross-ports
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

gcc-6
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-6-cross
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-6-cross-ports
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-7
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-7-cross
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-7-cross-ports
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-8
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-8-cross
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-8-cross-ports
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-9-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-9-cross-mipsen
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-9-cross-ports
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Does not exist

upstream Needs triage

xenial Does not exist

gcc-arm-linux-androideabi
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-arm-none-eabi
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-avr
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-defaults
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Needs triage

upstream Needs triage

xenial Needs triage

gcc-defaults-arm64-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-defaults-armel-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-defaults-armhf-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-defaults-powerpc-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-defaults-ppc64el-cross
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

gcc-h8300-hms
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-i686-linux-android
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-m68hc1x
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-mingw-w64
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Needs triage

upstream Needs triage

xenial Needs triage

gcc-msp430
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-opt
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-or1k-elf
Launchpad, Ubuntu, Debian
bionic Ignored
(end of standard support)
focal Does not exist

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
gcc-riscv64-unknown-elf
Launchpad, Ubuntu, Debian
bionic Ignored
(end of standard support)
focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
gcc-snapshot
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Needs triage

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Needs triage

gcc-xtensa-lx106
Launchpad, Ubuntu, Debian
bionic Ignored
(end of standard support)
focal Needs triage

jammy Needs triage

lunar Ignored
(end of life, was needs-triage)
mantic Needs triage

noble Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
gccgo-4.9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Needs triage

upstream Needs triage

xenial Does not exist

gccgo-6
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Needs triage

Severity score breakdown

Parameter Value
Base score 4.8
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N