CVE-2023-4039: GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-13 · updated 2026-10-14
Weakness: CWE-693

Description

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Affected products

GNU GCC: before 2023-09-12 — fixed in 2023-09-12

How to fix

Upgrade to a fixed version: GNU GCC 2023-09-12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4039 or the next vulnerability affects your stack