An update for gcc is now available for openEuler-24.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-1042 Final 1.0 1.0 2025-01-17 Initial 2025-01-17 2025-01-17 openEuler SA Tool V1.0 2025-01-17 gcc security update An update for gcc is now available for openEuler-24.03-LTS The gcc package contains the GNU Compiler Collection version 12. You'll need this package in order to compile C code. Security Fix(es): **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself. (CVE-2023-4039) An update for gcc is now available for openEuler-24.03-LTSLTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium gcc https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1042 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-4039 https://nvd.nist.gov/vuln/detail/CVE-2023-4039 openEuler-24.03-LTS cpp-12.3.1-38.oe2403.aarch64.rpm gcc-12.3.1-38.oe2403.aarch64.rpm gcc-c++-12.3.1-38.oe2403.aarch64.rpm gcc-debuginfo-12.3.1-38.oe2403.aarch64.rpm gcc-debugsource-12.3.1-38.oe2403.aarch64.rpm gcc-gdb-plugin-12.3.1-38.oe2403.aarch64.rpm gcc-gfortran-12.3.1-38.oe2403.aarch64.rpm gcc-objc++-12.3.1-38.oe2403.aarch64.rpm gcc-objc-12.3.1-38.oe2403.aarch64.rpm gcc-plugin-devel-12.3.1-38.oe2403.aarch64.rpm libasan-12.3.1-38.oe2403.aarch64.rpm libasan-static-12.3.1-38.oe2403.aarch64.rpm libatomic-12.3.1-38.oe2403.aarch64.rpm libatomic-static-12.3.1-38.oe2403.aarch64.rpm libgcc-12.3.1-38.oe2403.aarch64.rpm libgccjit-12.3.1-38.oe2403.aarch64.rpm libgccjit-devel-12.3.1-38.oe2403.aarch64.rpm libgfortran-12.3.1-38.oe2403.aarch64.rpm libgfortran-static-12.3.1-38.oe2403.aarch64.rpm libgomp-12.3.1-38.oe2403.aarch64.rpm libitm-12.3.1-38.oe2403.aarch64.rpm libitm-devel-12.3.1-38.oe2403.aarch64.rpm libitm-static-12.3.1-38.oe2403.aarch64.rpm liblsan-12.3.1-38.oe2403.aarch64.rpm liblsan-static-12.3.1-38.oe2403.aarch64.rpm libobjc-12.3.1-38.oe2403.aarch64.rpm libquadmath-12.3.1-38.oe2403.aarch64.rpm libquadmath-devel-12.3.1-38.oe2403.aarch64.rpm libquadmath-static-12.3.1-38.oe2403.aarch64.rpm libstdc++-12.3.1-38.oe2403.aarch64.rpm libstdc++-devel-12.3.1-38.oe2403.aarch64.rpm libstdc++-static-12.3.1-38.oe2403.aarch64.rpm libtsan-12.3.1-38.oe2403.aarch64.rpm libtsan-static-12.3.1-38.oe2403.aarch64.rpm libubsan-12.3.1-38.oe2403.aarch64.rpm libubsan-static-12.3.1-38.oe2403.aarch64.rpm cpp-12.3.1-38.oe2403.x86_64.rpm gcc-12.3.1-38.oe2403.x86_64.rpm gcc-c++-12.3.1-38.oe2403.x86_64.rpm gcc-debuginfo-12.3.1-38.oe2403.x86_64.rpm gcc-debugsource-12.3.1-38.oe2403.x86_64.rpm gcc-gdb-plugin-12.3.1-38.oe2403.x86_64.rpm gcc-gfortran-12.3.1-38.oe2403.x86_64.rpm gcc-objc++-12.3.1-38.oe2403.x86_64.rpm gcc-objc-12.3.1-38.oe2403.x86_64.rpm gcc-plugin-devel-12.3.1-38.oe2403.x86_64.rpm libasan-12.3.1-38.oe2403.x86_64.rpm libasan-static-12.3.1-38.oe2403.x86_64.rpm libatomic-12.3.1-38.oe2403.x86_64.rpm libatomic-static-12.3.1-38.oe2403.x86_64.rpm libgcc-12.3.1-38.oe2403.x86_64.rpm libgccjit-12.3.1-38.oe2403.x86_64.rpm libgccjit-devel-12.3.1-38.oe2403.x86_64.rpm libgfortran-12.3.1-38.oe2403.x86_64.rpm libgfortran-static-12.3.1-38.oe2403.x86_64.rpm libgomp-12.3.1-38.oe2403.x86_64.rpm libitm-12.3.1-38.oe2403.x86_64.rpm libitm-devel-12.3.1-38.oe2403.x86_64.rpm libitm-static-12.3.1-38.oe2403.x86_64.rpm liblsan-12.3.1-38.oe2403.x86_64.rpm liblsan-static-12.3.1-38.oe2403.x86_64.rpm libobjc-12.3.1-38.oe2403.x86_64.rpm libquadmath-12.3.1-38.oe2403.x86_64.rpm libquadmath-devel-12.3.1-38.oe2403.x86_64.rpm libquadmath-static-12.3.1-38.oe2403.x86_64.rpm libstdc++-12.3.1-38.oe2403.x86_64.rpm libstdc++-devel-12.3.1-38.oe2403.x86_64.rpm libstdc++-static-12.3.1-38.oe2403.x86_64.rpm libtsan-12.3.1-38.oe2403.x86_64.rpm libtsan-static-12.3.1-38.oe2403.x86_64.rpm libubsan-12.3.1-38.oe2403.x86_64.rpm libubsan-static-12.3.1-38.oe2403.x86_64.rpm gcc-12.3.1-38.oe2403.src.rpm **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself. 2025-01-17 CVE-2023-4039 openEuler-24.03-LTS Medium 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N gcc security update 2025-01-17 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1042