{"id":"CVE-2023-4039","state":"PUBLISHED","title":"GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.","publishedAt":"2023-09-13T08:05:10.274Z","updatedAt":"2026-10-14T21:23:13.065Z","severity":{"score":4.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"Arm"},"assigner":"Arm","products":["Arm Ltd Arm GNU Toolchain","GNU GCC"],"affected":[{"vendor":"Arm Ltd","product":"Arm GNU Toolchain","defaultStatus":"affected","versions":[{"version":"All versions where option -fstack-protector is used","status":"affected"}]},{"vendor":"GNU","product":"GCC","defaultStatus":"unaffected","versions":[{"version":"All versions of GCC that target AArch64 when option -fstack-protector is used","status":"affected"}]}],"references":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":["CWE-693"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4039.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-4039","state":"PUBLISHED","datePublished":"2023-09-13T08:05:10.274Z","dateUpdated":"2026-10-14T21:23:13.065Z","assignerShortName":"Arm","assignerOrgId":"56a131ea-b967-4a0d-a41e-5f3549952846","dateReserved":"2023-08-01T10:38:03.032Z"},"containers":{"cna":{"title":"GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64","descriptions":[{"lang":"en","value":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}],"affected":[{"vendor":"Arm Ltd","product":"Arm GNU Toolchain","defaultStatus":"affected","versions":[{"version":"All versions where option -fstack-protector is used","status":"affected"}]},{"vendor":"GNU","product":"GCC","defaultStatus":"unaffected","versions":[{"version":"All versions of GCC that target AArch64 when option -fstack-protector is used","status":"affected"}]}],"references":[{"url":"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"},{"url":"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-693","description":"CWE-693 Protection Mechanism Failure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Arm","orgId":"56a131ea-b967-4a0d-a41e-5f3549952846","dateUpdated":"2024-06-13T22:20:07.881Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The specific conditions where the stack-protector fails to give the desired level of protection are when:\n\n\n\n

And to be exploitable there must also be a prior vulnerability in the\n program such that an attacker can cause a buffer overflow in these \nlocal variables that overwrites saved register values in the stack.

\n\n
"}],"value":"The specific conditions where the stack-protector fails to give the desired level of protection are when:\n\n\n\n * using GCC (all unpatched versions) targeting AArch64\n\n * and when the -fstack-protector option is used\n\n * and when the program uses C99-style dynamically-sized local variables or alloca()\n\n\n\n\nAnd to be exploitable there must also be a prior vulnerability in the\n program such that an attacker can cause a buffer overflow in these \nlocal variables that overwrites saved register values in the stack."}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Tom Hebb from Meta Red Team X and Maria Markstedter from Azeria Labs"}],"datePublic":"2023-09-12T09:00:00.000Z","tags":["disputed"],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Recompile vulnerable code using an updated toolchain.\n\n
"}],"value":"Recompile vulnerable code using an updated toolchain."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"arm-security@arm.com","ID":"CVE-2023-4039","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Arm GNU Toolchain","version":{"version_data":[{"version_value":"All versions of GCC that target AArch64 when option -fstack-protector is used"}]}}]},"vendor_name":"Arm Ltd"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"5.0","description":{"description_data":[{"lang":"eng","value":"**DISPUTED** A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64"}]}]},"references":{"reference_data":[{"name":"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","refsource":"MISC","url":"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","tags":["x_transferred"]},{"url":"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:17:11.837Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-4039","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-03T16:04:55.934999Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-23T17:19:09.321Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-14T21:23:13.065Z"},"x_adpType":"supplier"}]}}}