Skip to content
OpenAdvisories
Medium USN-7700-1 1 CVE

gcc-10, gcc-11, gcc-12 vulnerability

Published Aug 19, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the -fstack-protector hardening feature in GCC for
AArch64 did not properly protect dynamically-sized local variables
such as those created using C99 variable length arrays or alloca. As a
result, an attacker who was able to trigger a buffer overflow in such cases
could bypass the intended stack protection checks. (CVE-2023-4039)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS gcc-10 10.5.0-1ubuntu1~22.04.2
Ubuntu · 22.04 LTS 22.04:LTS gcc-11 11.4.0-1ubuntu1~22.04.2
Ubuntu · 22.04 LTS 22.04:LTS gcc-12 12.3.0-1ubuntu1~22.04.2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS gcc-10 10.5.0-1ubuntu1~20.04.1+esm1

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-4039

    GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

    **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-prote…

    GNU Arm gcc Arm GNU Toolchain Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2023-4039