Skip to content
Fencer Vulns
medium 4.8

CVE-2023-4039 json

GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

published 2023-09-13 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-53931

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.

The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens RUGGEDCOM RST2428P V3.2
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family V3.2
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family V3.2
  • gcc-12 Debian 12 12.2.0-14+deb12u1
  • gcc-12 Debian 14, Debian 13 12.3.0-9
  • gcc-13 Debian 14, Debian 13 13.2.0-4

debian advisories DEBIAN-CVE-2023-4039

  • gcc-9 Ubuntu 24.04 LTS 9.5.0-6ubuntu2
  • gcc-10 Ubuntu 22.04 LTS 10.5.0-1ubuntu1~22.04.2
  • gcc-10 Ubuntu 24.04 LTS 10.5.0-4ubuntu2
  • gcc-11 Ubuntu 22.04 LTS 11.4.0-1ubuntu1~22.04.2
  • gcc-11 Ubuntu 24.04 LTS 11.4.0-4ubuntu1
  • gcc-12 Ubuntu 22.04 LTS 12.3.0-1ubuntu1~22.04.2
  • gcc-9-cross Ubuntu 24.04 LTS 29ubuntu2
  • gcc-10-cross Ubuntu 24.04 LTS 23ubuntu2

ubuntu advisories UBUNTU-CVE-2023-4039

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gcc13 SLE Module for Package Hub 15 SP5, SLE Module for Package Hub 15 SP4, SLE Module for Development Tools 15 SP5 +28 more 13.2.1+git7813-150000.1.6.1
  • gcc13 SLES for SAP 12 SP5, SLES 12 SP5, SLE Module for Toolchain 12 13.2.1+git7813-1.10.1
  • cross-nvptx-gcc13 SLE Module for Toolchain 12 13.2.1+git7813-1.10.1
  • cross-nvptx-gcc13 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +12 more 13.2.1+git7813-150000.1.6.1
  • gcc13 SLE Module for Package Hub 15 SP5, SLE Module for Package Hub 15 SP4, SLE Module for Development Tools 15 SP5 +18 more 13.2.1+git7813-150000.1.3.3
  • cross-nvptx-gcc13 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 13.2.1+git7813-150000.1.3.2
  • gcc7 SLES for SAP 15 SP1, SLE Module for Basesystem 15 SP4 7.5.0+r278197-150000.4.35.1
  • gcc7 SLES for SAP 12 SP5, SLES 12 SP5, SLE Module for Toolchain 12 7.5.0+r278197-13.1

suse advisories SUSE-SU-2024:0045-1SUSE-SU-2023:4480-1SUSE-SU-2023:4458-1SUSE-SU-2023:4162-1SUSE-SU-2023:3686-1SUSE-SU-2023:3662-1

  • gcc12 openSUSE Tumbleweed 12.3.0+git1204-2.1
  • gcc13 openSUSE Tumbleweed 13.2.1+git7813-1.1
  • gcc7 openSUSE Tumbleweed 7.5.0+r278197-15.1

opensuse advisories openSUSE-SU-2024:13233-1openSUSE-SU-2024:13234-1openSUSE-SU-2024:13235-1

  • gcc Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 13.2.1_git20231014-r0

alpine advisories ALPINE-CVE-2023-4039

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gcc CBL-Mariner 2.0 11.2.0-6
  • gcc Azure Linux 3.0 13.2.0-7

azure linux advisories AZL-28769AZL-34695

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4039 updated cvss 0.0

gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64

  • Red Hat Advanced Cluster Management for Kubernetes 2 gcc
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 6 cpp, gcc, libgcc, libgcj, libitm, gcc-c++, +23 more Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +20 more Red Hat OpenShift Container Platform 3.11 gcc
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Data Science (RHODS) gcc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 gcc
    affected: workaround, no fix available
  • Red Hat Virtualization 4 cpp, gcc, libgcc, libgomp
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cryostat 2 gcc Red Hat Migration Toolkit for Containers gcc Red Hat 3scale API Management Platform 2 gcc Red Hat Enterprise Linux 8 cpp, gcc, libgcc, libitm, gcc-c++, libasan, +33 more Red Hat Enterprise Linux 9 cpp, gcc, libgcc, libitm, gcc-c++, libasan, +27 more Red Hat OpenShift Container Platform 4 gcc
    +1 more products
    Red Hat OpenShift Dev Spaces gcc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-226-07 updated cvss 4.8

Siemens Third-Party Components in SINEC OS

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.2
    affected: fixed in V3.2 support.industry.siemens.com
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.2
    affected: fixed in V3.2
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.2
    affected: fixed in V3.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-348-10 updated cvss 4.8

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • developer.arm.com https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

  • Arm Ltd Arm GNU Toolchain
  • GNU GCC
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM RST2428P
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family

Classification

Weakness
  • CWE-693 Protection Mechanism Failure

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.