CVE-2018-12886
22.05.2019, 19:29
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gnu | gcc | 4.1 ≤ 𝑥 ≤ 8.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gcc-4.8 |
| ||||||||||||||||||||||||||||||
| gcc-4.9 |
| ||||||||||||||||||||||||||||||
| gcc-6 |
| ||||||||||||||||||||||||||||||
| gcc-7 |
| ||||||||||||||||||||||||||||||
| gcc-8 |
| ||||||||||||||||||||||||||||||
| gcc-9 |
| ||||||||||||||||||||||||||||||
| gcc-arm-none-eabi |
| ||||||||||||||||||||||||||||||
| gcc-avr |
| ||||||||||||||||||||||||||||||
| gcc-h8300-hms |
| ||||||||||||||||||||||||||||||
| gcc-m68hc1x |
| ||||||||||||||||||||||||||||||
| gcc-msp430 |
| ||||||||||||||||||||||||||||||
| gcc-snapshot |
|
Common Weakness Enumeration