Описание
Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.
It was found that targets using gcc's libssp library for Stack Smashing Protection (among others: Cygwin, MinGW, newlib, RTEMS; but not Glibc, Bionic, NetBSD which provide SSP in libc), are missing the Object Size Checking feature, even when explicitly requested with _FORTIFY_SOURCE. Vulnerable binaries compiled against such targets do not benefit of such protection, increasing the chances of success of a buffer overflow attack.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | compat-gcc-295 | Not affected | ||
| Red Hat Enterprise Linux 5 | compat-gcc-296 | Not affected | ||
| Red Hat Enterprise Linux 5 | compat-gcc-32 | Not affected | ||
| Red Hat Enterprise Linux 5 | compat-gcc-34 | Not affected | ||
| Red Hat Enterprise Linux 5 | gcc | Not affected | ||
| Red Hat Enterprise Linux 5 | gcc44 | Not affected | ||
| Red Hat Enterprise Linux 6 | compat-gcc-295 | Not affected | ||
| Red Hat Enterprise Linux 6 | compat-gcc-296 | Not affected | ||
| Red Hat Enterprise Linux 6 | compat-gcc-32 | Not affected | ||
| Red Hat Enterprise Linux 6 | compat-gcc-34 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
3.6 Low
CVSS3
Связанные уязвимости
Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.
Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.
Binaries compiled against targets that use the libssp library in GCC f ...
Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.
EPSS
3.6 Low
CVSS3