stackprotectprologue in cfgexpand.c and stackprotectepilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Description of problem:

Jake Edge has reported the following gcc kernel related potential security issue on LWN:

<cite>

A change to GCC for a recent release coupled with a kernel bug has created a messy situation, with possible security implications. GCC changed some assumptions about x86 processor flags, in accordance with the ABI standard, that can lead to memory corruption for programs built with GCC 4.3.0. No one has come up with a way to exploit the flaw, at least yet, but it clearly is a problem that needs to be addressed.

The problem revolves around the x86 direction flag (DF), which governs whether block memory operations operate forward through memory or backwards. The main use for the flag is to support overlapping memory copies, where working backwards through memory may be required so that the data being copied does not get overwritten as the copy progresses. Debian hacker Aurélien Jarno reported the problem to linux-kernel on March 5th, which was found when building Steel Bank Common Lisp (SBCL) using the new compiler.

GCC's most recent release, 4.3.0, assumes that the direction flag has been cleared (i.e. memory operations go in a forward direction) at the entry of each function, as is specified by the ABI (which is, somewhat amusingly, found at sco.com [PDF]). Unfortunately, this clashes with Linux signal handlers, which get called, incorrectly, with the flag in whatever state it was in when the signal occurred. This has the effect of leaking one bit of state from the user space process that was running when the signal occurred to the signal handler, which could be in another process.

That, in itself, is a bug, seemingly with fairly minimal impact. Prior to 4.3, GCC would emit a cld (clear direction flag) opcode before doing inline string or memory operations, so those operations would start from a known state. In 4.3, GCC relies on the ABI mandate that the direction flag is cleared before entry to a function, which means that the kernel needs to arrange that before calling a signal handler. It currently doesn't, but a small patch fixes that.

The window of vulnerability is small, but was observed in SBCL. The sequence of events that would lead to memory corruption are as follows:

a user space program does an operation (memmove() for example) that sets DF a signal occurs for some process the kernel calls the signal handler the signal handler does a memmove() in what it thinks is a forward direction the memory is copied in the reverse direction, leading to corruption

</cite>

Link to the post:

http://lwn.net/Articles/272048/#Comments

Link to upstream fix:

http://git.kernel.org/?p=linux/kernel/git/x86/linux-2.6-x86.git;a=commitdiff;h=52c841e1012b8e73cc04b53f92fb933db580fb42

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the builtindarn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every builtindarn() call may be the same.

DISPUTED gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999).

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangleconst, as demonstrated by nm-new.

It was discovered that the std::randomdevice class in libstdc++ would not properly detect short reads and could return return predictable values if applications used it to obtain randomness from a blocking source such as /dev/random.

Under certain circumstances, the ix86expandbuiltin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported.

Upstream bug:

https://gcc.gnu.org/bugzilla/showbug.cgi?id=80180

Upstream patch:

https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html

References:

http://seclists.org/oss-sec/2017/q3/218

Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code.

Upstream fix:

https://gcc.gnu.org/viewcvs/gcc?limitchanges=0&view=revision&revision=211721

These will be included in a later release of GCC.

References:

http://seclists.org/oss-sec/2014/q3/230

The gcc packages include C, C++, Java, Fortran 77, Objective C, and Ada 95GNU compilers and related support libraries.Jürgen Weigert discovered a directory traversal flaw in fastjar. Anattacker could create a malicious JAR file which, if unpacked usingfastjar, could write to any files the victim had write access to.(CVE-2006-3619)These updated packages also fix a reload internal compiler error withfnon-call-exceptions option. All users of gcc should upgrade to these updated packages, which resolvethese issues.

The gcc packages include C, C++, Java, Fortran 77, Objective C, and Ada 95GNU compilers and related support libraries.Jürgen Weigert discovered a directory traversal flaw in fastjar. Anattacker could create a malicious JAR file which, if unpacked usingfastjar, could write to any files the victim had write access to.(CVE-2006-3619)These updated packages also fix several bugs, including: two debug information generator bugs two internal compiler errors In addition to this, protoize.1 and unprotoize.1 manual pages have beenadded to the package and cxagetexceptionptr@@CXXABI1.3.1 symbol hasbeen added into libstdc++.so.6.For full details regarding all fixed bugs, refer to the package changelogas well as the specified list of bug reports from bugzilla.All users of gcc should upgrade to these updated packages, which containbackported patches to resolve these issues.