CVE-2023-4039 (GCVE-0-2023-4039)

Vulnerability from cvelistv5 – Published: 2023-09-13 08:05 – Updated: 2026-06-23 17:19 Disputed
VLAI
Title
GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64
Summary
**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-693 - Protection Mechanism Failure
Assigner
Arm
References
Impacted products
Vendor Product Version
Arm Ltd Arm GNU Toolchain Affected: All versions where option -fstack-protector is used
Create a notification for this product.
GNU GCC Affected: All versions of GCC that target AArch64 when option -fstack-protector is used
Create a notification for this product.
Date Public
2023-09-12 09:00
Credits
Tom Hebb from Meta Red Team X and Maria Markstedter from Azeria Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:17:11.837Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4039",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T16:04:55.934999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:19:09.321Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Arm GNU Toolchain",
          "vendor": "Arm Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "All versions where option -fstack-protector is used"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GCC",
          "vendor": "GNU",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of GCC that target AArch64 when option -fstack-protector is used"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The specific conditions where the stack-protector fails to give the desired level of protection are when:\n\n\n\u003cul\u003e\n    \u003cli\u003eusing GCC (all unpatched versions) targeting AArch64\u003c/li\u003e\n    \u003cli\u003eand when the -fstack-protector option is used\u003c/li\u003e\n    \u003cli\u003eand when the program uses C99-style dynamically-sized local variables or alloca()\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAnd to be exploitable there must also be a prior vulnerability in the\n program such that an attacker can cause a buffer overflow in these \nlocal variables that overwrites saved register values in the stack.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "The specific conditions where the stack-protector fails to give the desired level of protection are when:\n\n\n\n      *  using GCC (all unpatched versions) targeting AArch64\n\n      *  and when the -fstack-protector option is used\n\n      *  and when the program uses C99-style dynamically-sized local variables or alloca()\n\n\n\n\nAnd to be exploitable there must also be a prior vulnerability in the\n program such that an attacker can cause a buffer overflow in these \nlocal variables that overwrites saved register values in the stack."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tom Hebb from Meta Red Team X and Maria Markstedter from Azeria Labs"
        }
      ],
      "datePublic": "2023-09-12T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\u003c/p\u003e\u003cp\u003e**DISPUTED** A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\u003c/p\u003e\u003cp\u003eThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693 Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-13T22:20:07.881Z",
        "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
        "shortName": "Arm"
      },
      "references": [
        {
          "url": "https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"
        },
        {
          "url": "https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Recompile vulnerable code using an updated toolchain.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Recompile vulnerable code using an updated toolchain."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "disputed"
      ],
      "title": "GCC\u0027s-fstack-protector fails to guard dynamically-sized local variables on AArch64",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "arm-security@arm.com",
          "ID": "CVE-2023-4039",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Arm GNU Toolchain",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions of GCC that target AArch64 when option -fstack-protector is used"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Arm Ltd"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "5.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "**DISPUTED** A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "GCC\u0027s-fstack-protector fails to guard dynamically-sized local variables on AArch64"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64",
              "refsource": "MISC",
              "url": "https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
    "assignerShortName": "Arm",
    "cveId": "CVE-2023-4039",
    "datePublished": "2023-09-13T08:05:10.274Z",
    "dateReserved": "2023-08-01T10:38:03.032Z",
    "dateUpdated": "2026-06-23T17:19:09.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-4039",
      "date": "2026-07-20",
      "epss": "0.00758",
      "percentile": "0.51142"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:arm64:*\", \"versionEndExcluding\": \"2023-09-12\", \"matchCriteriaId\": \"C8373A25-594D-4F3F-981B-0D02056992FC\"}]}]}]",
      "cveTags": "[{\"sourceIdentifier\": \"arm-security@arm.com\", \"tags\": [\"disputed\"]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\n\\n**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \\nthat target AArch64 allows an attacker to exploit an existing buffer \\noverflow in dynamically-sized local variables in your application \\nwithout this being detected. This stack-protector failure only applies \\nto C99-style dynamically-sized local variables or those created using \\nalloca(). The stack-protector operates as intended for statically-sized \\nlocal variables.\\n\\nThe default behavior when the stack-protector \\ndetects an overflow is to terminate your application, resulting in \\ncontrolled loss of availability. An attacker who can exploit a buffer \\noverflow without triggering the stack-protector might be able to change \\nprogram flow control to cause an uncontrolled loss of availability or to\\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\\n\\n\\n\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Una falla en la funci\\u00f3n -fstack-protector en cadenas de herramientas basadas en GCC que apuntan a AArch64 permite a un atacante explotar un Desbordamiento de B\\u00fafer existente en variables locales de tama\\u00f1o din\\u00e1mico en su aplicaci\\u00f3n sin que esto sea detectado. Esta falla del protector de pila solo se aplica a variables locales de tama\\u00f1o din\\u00e1mico estilo C99 o aquellas creadas usando alloca(). El protector de pila funciona seg\\u00fan lo previsto para variables locales de tama\\u00f1o est\\u00e1tico. El comportamiento predeterminado cuando el protector de pila detecta un desbordamiento es finalizar su aplicaci\\u00f3n, lo que resulta en una p\\u00e9rdida controlada de disponibilidad. Un atacante que pueda aprovechar un Desbordamiento del B\\u00fafer sin activar el protector de pila podr\\u00eda cambiar el control de flujo del programa para provocar una p\\u00e9rdida incontrolada de disponibilidad o ir m\\u00e1s all\\u00e1 y afectar la confidencialidad o la integridad.\"}]",
      "id": "CVE-2023-4039",
      "lastModified": "2024-11-21T08:34:16.613",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"arm-security@arm.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 2.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 2.5}]}",
      "published": "2023-09-13T09:15:15.690",
      "references": "[{\"url\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\", \"source\": \"arm-security@arm.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\", \"source\": \"arm-security@arm.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "arm-security@arm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"arm-security@arm.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-693\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2024-07-03T00:00:00.000Z",
      "cve": "CVE-2023-4039",
      "id": "msrc_CVE-2023-4039",
      "initial_release_date": "2023-09-01T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "GCC\u0027s-fstack-protector fails to guard dynamically-sized local variables on AArch64",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2023-4039.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-4039\",\"sourceIdentifier\":\"arm-security@arm.com\",\"published\":\"2023-09-13T09:15:15.690\",\"lastModified\":\"2026-06-23T18:17:35.723\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"arm-security@arm.com\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \\nthat target AArch64 allows an attacker to exploit an existing buffer \\noverflow in dynamically-sized local variables in your application \\nwithout this being detected. This stack-protector failure only applies \\nto C99-style dynamically-sized local variables or those created using \\nalloca(). The stack-protector operates as intended for statically-sized \\nlocal variables.\\n\\nThe default behavior when the stack-protector \\ndetects an overflow is to terminate your application, resulting in \\ncontrolled loss of availability. An attacker who can exploit a buffer \\noverflow without triggering the stack-protector might be able to change \\nprogram flow control to cause an uncontrolled loss of availability or to\\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\"},{\"lang\":\"es\",\"value\":\"Una falla en la funci\u00f3n -fstack-protector en cadenas de herramientas basadas en GCC que apuntan a AArch64 permite a un atacante explotar un Desbordamiento de B\u00fafer existente en variables locales de tama\u00f1o din\u00e1mico en su aplicaci\u00f3n sin que esto sea detectado. Esta falla del protector de pila solo se aplica a variables locales de tama\u00f1o din\u00e1mico estilo C99 o aquellas creadas usando alloca(). El protector de pila funciona seg\u00fan lo previsto para variables locales de tama\u00f1o est\u00e1tico. El comportamiento predeterminado cuando el protector de pila detecta un desbordamiento es finalizar su aplicaci\u00f3n, lo que resulta en una p\u00e9rdida controlada de disponibilidad. Un atacante que pueda aprovechar un Desbordamiento del B\u00fafer sin activar el protector de pila podr\u00eda cambiar el control de flujo del programa para provocar una p\u00e9rdida incontrolada de disponibilidad o ir m\u00e1s all\u00e1 y afectar la confidencialidad o la integridad.\"}],\"affected\":[{\"source\":\"arm-security@arm.com\",\"affectedData\":[{\"vendor\":\"Arm Ltd\",\"product\":\"Arm GNU Toolchain\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"All versions where option -fstack-protector is used\",\"status\":\"affected\"}]},{\"vendor\":\"GNU\",\"product\":\"GCC\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"All versions of GCC that target AArch64 when option -fstack-protector is used\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"arm-security@arm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-06-03T16:04:55.934999Z\",\"id\":\"CVE-2023-4039\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"arm-security@arm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-693\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:arm64:*\",\"versionEndExcluding\":\"2023-09-12\",\"matchCriteriaId\":\"C8373A25-594D-4F3F-981B-0D02056992FC\"}]}]}],\"references\":[{\"url\":\"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\",\"source\":\"arm-security@arm.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\",\"source\":\"arm-security@arm.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-03-04T15:17:17+00:00",
      "cve": "CVE-2023-4039",
      "id": "CVE-2023-4039",
      "initial_release_date": "2023-09-12T15:00:00+00:00",
      "product_status:known_affected": "88",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-4039.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-07T15:42:18Z",
      "cve": "CVE-2023-4039",
      "id": "CVE-2023-4039",
      "initial_release_date": "2023-09-15T02:11:31Z",
      "product_status:first_fixed": "22",
      "product_status:known_affected": "372",
      "product_status:known_not_affected": "246",
      "product_status:recommended": "4870",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-4039",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-4039.json",
      "version": "159"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T07:17:11.837Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-4039\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-03T16:04:55.934999Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-03T16:04:57.271Z\"}}], \"cna\": {\"tags\": [\"disputed\"], \"title\": \"GCC\u0027s-fstack-protector fails to guard dynamically-sized local variables on AArch64\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Tom Hebb from Meta Red Team X and Maria Markstedter from Azeria Labs\"}], \"impacts\": [{\"capecId\": \"CAPEC-100\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-100 Overflow Buffers\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arm Ltd\", \"product\": \"Arm GNU Toolchain\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions where option -fstack-protector is used\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"GNU\", \"product\": \"GCC\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions of GCC that target AArch64 when option -fstack-protector is used\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Recompile vulnerable code using an updated toolchain.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Recompile vulnerable code using an updated toolchain.\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2023-09-12T09:00:00.000Z\", \"references\": [{\"url\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\"}, {\"url\": \"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \\nthat target AArch64 allows an attacker to exploit an existing buffer \\noverflow in dynamically-sized local variables in your application \\nwithout this being detected. This stack-protector failure only applies \\nto C99-style dynamically-sized local variables or those created using \\nalloca(). The stack-protector operates as intended for statically-sized \\nlocal variables.\\n\\nThe default behavior when the stack-protector \\ndetects an overflow is to terminate your application, resulting in \\ncontrolled loss of availability. An attacker who can exploit a buffer \\noverflow without triggering the stack-protector might be able to change \\nprogram flow control to cause an uncontrolled loss of availability or to\\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\\n\u003c/p\u003e\u003cp\u003e**DISPUTED** A failure in the -fstack-protector feature in GCC-based toolchains \\nthat target AArch64 allows an attacker to exploit an existing buffer \\noverflow in dynamically-sized local variables in your application \\nwithout this being detected. This stack-protector failure only applies \\nto C99-style dynamically-sized local variables or those created using \\nalloca(). The stack-protector operates as intended for statically-sized \\nlocal variables.\u003c/p\u003e\u003cp\u003eThe default behavior when the stack-protector \\ndetects an overflow is to terminate your application, resulting in \\ncontrolled loss of availability. An attacker who can exploit a buffer \\noverflow without triggering the stack-protector might be able to change \\nprogram flow control to cause an uncontrolled loss of availability or to\\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\u003c/p\u003e\\n\\n\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-693\", \"description\": \"CWE-693 Protection Mechanism Failure\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The specific conditions where the stack-protector fails to give the desired level of protection are when:\\n\\n\\n\\n      *  using GCC (all unpatched versions) targeting AArch64\\n\\n      *  and when the -fstack-protector option is used\\n\\n      *  and when the program uses C99-style dynamically-sized local variables or alloca()\\n\\n\\n\\n\\nAnd to be exploitable there must also be a prior vulnerability in the\\n program such that an attacker can cause a buffer overflow in these \\nlocal variables that overwrites saved register values in the stack.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The specific conditions where the stack-protector fails to give the desired level of protection are when:\\n\\n\\n\u003cul\u003e\\n    \u003cli\u003eusing GCC (all unpatched versions) targeting AArch64\u003c/li\u003e\\n    \u003cli\u003eand when the -fstack-protector option is used\u003c/li\u003e\\n    \u003cli\u003eand when the program uses C99-style dynamically-sized local variables or alloca()\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003cp\u003eAnd to be exploitable there must also be a prior vulnerability in the\\n program such that an attacker can cause a buffer overflow in these \\nlocal variables that overwrites saved register values in the stack.\u003c/p\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"56a131ea-b967-4a0d-a41e-5f3549952846\", \"shortName\": \"Arm\", \"dateUpdated\": \"2024-06-13T22:20:07.881Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"All versions of GCC that target AArch64 when option -fstack-protector is used\"}]}, \"product_name\": \"Arm GNU Toolchain\"}]}, \"vendor_name\": \"Arm Ltd\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\", \"name\": \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"**DISPUTED** A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"GCC\u0027s-fstack-protector fails to guard dynamically-sized local variables on AArch64\"}]}]}, \"data_version\": \"5.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2023-4039\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"arm-security@arm.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-4039\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-23T17:19:09.321Z\", \"dateReserved\": \"2023-08-01T10:38:03.032Z\", \"assignerOrgId\": \"56a131ea-b967-4a0d-a41e-5f3549952846\", \"datePublished\": \"2023-09-13T08:05:10.274Z\", \"assignerShortName\": \"Arm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.