oss-sec mailing list archives
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions
From: Mikhail Klementev <jollheef () riseup net>
Date: Mon, 22 Oct 2018 20:31:02 +0000
Hello, It was described in GCC documentation even from 2003: https://web.archive.org/web/20030207183940/http://gcc.gnu.org:80/onlinedocs/gccint/Trampolines.html What's difference between vulnerability you found and behavior that was described in the documentation? On Mon, Oct 22, 2018 at 03:07:55PM +0000, Andrew Sandoval wrote:
... Technical Description of the vulnerability When nested C functions are compiled by GCC, code is generated which causes the call stack of the currently executing thread to be made executable prior to the call to a nested function and for the duration of the thread's lifetime. This is essentially the equivalent of disabling Data Execution Prevention (DEP). A stack overflow, etc., that is able to place instructions on the page(s) of memory made executable has the potential of gaining execution and running malware, etc. This places the process at substantial risk of being exploited. ...
-- With eval and apply, Mikhail Klementev.
Attachment:
signature.asc
Description:
Current thread:
- GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Andrew Sandoval (Oct 22)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Florian Weimer (Oct 22)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Ramon de C Valle (Oct 23)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Solar Designer (Oct 23)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Jordan Glover (Oct 24)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Florian Weimer (Oct 22)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Mikhail Klementev (Oct 23)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Yann Droneaud (Oct 23)
- Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Matthew Fernandez (Oct 23)