SUSE update for gcc12

1) Security features bypass

EUVDB-ID: #VU81045

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4039

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the GCC's stack smashing protection does not detect or defend against overflows of dynamically-sized local variables on AArch64 targets. A remote attacker can bypass expected security restrictions and successfully exploit buffer overflow vulnerabilities.

Mitigation

Update the affected package gcc12 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro: 5.1 - 5.5

openSUSE Leap Micro: 5.3 - 5.4

Development Tools Module: 15-SP4 - 15-SP5

SUSE Package Hub 15: 15-SP4 - 15-SP5

Basesystem Module: 15-SP4 - 15-SP5

SUSE Linux Enterprise Micro for Rancher: 5.2 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5

SUSE Linux Enterprise Server 15: SP1 - SP5

SUSE Linux Enterprise Real Time 15: SP4 - SP5

SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5

SUSE Linux Enterprise Desktop 15: SP4 - SP5

Legacy Module: 15-SP4

SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3

SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise Server 15 SP1 LTSS: 15-SP1

SUSE Linux Enterprise High Performance Computing LTSS 15: SP3

SUSE Linux Enterprise High Performance Computing ESPOS 15: SP3

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS: 15-SP1

SUSE Enterprise Storage: 7.1

SUSE Manager Retail Branch Server: 4.2 - 4.3

SUSE Manager Server: 4.2 - 4.3

SUSE Manager Proxy: 4.2 - 4.3

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.4

libhwasan0-debuginfo: before 12.3.0+git1204-150000.1.16.1

libhwasan0: before 12.3.0+git1204-150000.1.16.1

libquadmath0-debuginfo: before 12.3.0+git1204-150000.1.16.1

libquadmath0: before 12.3.0+git1204-150000.1.16.1

libubsan1-32bit: before 12.3.0+git1204-150000.1.16.1

libobjc4-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libstdc++6-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgfortran5-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libobjc4-32bit: before 12.3.0+git1204-150000.1.16.1

libubsan1-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgomp1-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgfortran5-32bit: before 12.3.0+git1204-150000.1.16.1

libgcc_s1-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libitm1-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libatomic1-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libatomic1-32bit: before 12.3.0+git1204-150000.1.16.1

libitm1-32bit: before 12.3.0+git1204-150000.1.16.1

libgcc_s1-32bit: before 12.3.0+git1204-150000.1.16.1

libstdc++6-32bit: before 12.3.0+git1204-150000.1.16.1

libgomp1-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-info: before 12.3.0+git1204-150000.1.16.1

libgdruntime3: before 12.3.0+git1204-150000.1.16.1

gcc12-d: before 12.3.0+git1204-150000.1.16.1

libgphobos3-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgphobos3: before 12.3.0+git1204-150000.1.16.1

libgdruntime3-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-d-debuginfo: before 12.3.0+git1204-150000.1.16.1

cross-nvptx-newlib12-devel: before 12.3.0+git1204-150000.1.16.1

libada12-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libada12-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-fortran-32bit: before 12.3.0+git1204-150000.1.16.1

libgphobos3-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-c++-32bit: before 12.3.0+git1204-150000.1.16.1

libgphobos3-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-go-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-objc-32bit: before 12.3.0+git1204-150000.1.16.1

cross-nvptx-gcc12-debuginfo: before 12.3.0+git1204-150000.1.16.1

cross-nvptx-gcc12-debugsource: before 12.3.0+git1204-150000.1.16.1

libstdc++6-pp-32bit: before 12.3.0+git1204-150000.1.16.1

libquadmath0-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-32bit: before 12.3.0+git1204-150000.1.16.1

libquadmath0-32bit: before 12.3.0+git1204-150000.1.16.1

libgo21-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-d-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-obj-c++-32bit: before 12.3.0+git1204-150000.1.16.1

libstdc++6-devel-gcc12-32bit: before 12.3.0+git1204-150000.1.16.1

gcc12-ada-32bit: before 12.3.0+git1204-150000.1.16.1

libasan8-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgdruntime3-32bit: before 12.3.0+git1204-150000.1.16.1

libasan8-32bit: before 12.3.0+git1204-150000.1.16.1

cross-nvptx-gcc12: before 12.3.0+git1204-150000.1.16.1

libgdruntime3-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgo21-32bit-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgfortran5-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-locale: before 12.3.0+git1204-150000.1.16.1

libasan8: before 12.3.0+git1204-150000.1.16.1

libasan8-debuginfo: before 12.3.0+git1204-150000.1.16.1

cpp12: before 12.3.0+git1204-150000.1.16.1

gcc12-go: before 12.3.0+git1204-150000.1.16.1

gcc12: before 12.3.0+git1204-150000.1.16.1

liblsan0: before 12.3.0+git1204-150000.1.16.1

gcc12-obj-c++-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgomp1-debuginfo: before 12.3.0+git1204-150000.1.16.1

libubsan1: before 12.3.0+git1204-150000.1.16.1

gcc12-objc: before 12.3.0+git1204-150000.1.16.1

libitm1-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-fortran: before 12.3.0+git1204-150000.1.16.1

cpp12-debuginfo: before 12.3.0+git1204-150000.1.16.1

libatomic1: before 12.3.0+git1204-150000.1.16.1

gcc12-PIE: before 12.3.0+git1204-150000.1.16.1

libstdc++6-locale: before 12.3.0+git1204-150000.1.16.1

libada12: before 12.3.0+git1204-150000.1.16.1

libgfortran5: before 12.3.0+git1204-150000.1.16.1

gcc12-ada-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgo21-debuginfo: before 12.3.0+git1204-150000.1.16.1

libubsan1-debuginfo: before 12.3.0+git1204-150000.1.16.1

libobjc4-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-objc-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-obj-c++: before 12.3.0+git1204-150000.1.16.1

libatomic1-debuginfo: before 12.3.0+git1204-150000.1.16.1

libada12-debuginfo: before 12.3.0+git1204-150000.1.16.1

libobjc4: before 12.3.0+git1204-150000.1.16.1

gcc12-go-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgo21: before 12.3.0+git1204-150000.1.16.1

libstdc++6-pp: before 12.3.0+git1204-150000.1.16.1

liblsan0-debuginfo: before 12.3.0+git1204-150000.1.16.1

libgomp1: before 12.3.0+git1204-150000.1.16.1

gcc12-c++: before 12.3.0+git1204-150000.1.16.1

libitm1: before 12.3.0+git1204-150000.1.16.1

gcc12-testresults: before 12.3.0+git1204-150000.1.16.1

gcc12-c++-debuginfo: before 12.3.0+git1204-150000.1.16.1

libtsan2-debuginfo: before 12.3.0+git1204-150000.1.16.1

libtsan2: before 12.3.0+git1204-150000.1.16.1

gcc12-fortran-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-ada: before 12.3.0+git1204-150000.1.16.1

libstdc++6-devel-gcc12: before 12.3.0+git1204-150000.1.16.1

libgcc_s1: before 12.3.0+git1204-150000.1.16.1

libstdc++6: before 12.3.0+git1204-150000.1.16.1

gcc12-debuginfo: before 12.3.0+git1204-150000.1.16.1

gcc12-debugsource: before 12.3.0+git1204-150000.1.16.1

libgcc_s1-debuginfo: before 12.3.0+git1204-150000.1.16.1

libstdc++6-debuginfo: before 12.3.0+git1204-150000.1.16.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20233661-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.