Stack Overflow Bypass in GNU Compiler Collection for ARM Targets

CVE-2018-12886

Summary

The GNU Compiler Collection (GCC) versions 4.1 through 8, when targeting ARM architectures, may generate flawed instruction sequences in specific circumstances. This can result in the spilling of the stack protector guard address, enabling a malicious actor to bypass various stack protection features such as -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit. Consequently, this weakness can lead to potential exploitation through crafted inputs that manipulate the expected operation of the stack canary.

References