CVE-2018-12886

Name of the Vulnerable Software and Affected Versions GNU Compiler Collection (GCC) versions 4.1 through 8

Description The issue is related to the stack protect prologue in cfgexpand.c and stack protect epilogue in function.c functions in GNU Compiler Collection (GCC). When targeting ARM targets, these functions can generate instruction sequences that spill the address of the stack protector guard, allowing an attacker to bypass the protection of stack overflow mitigations. This could potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For GNU Compiler Collection (GCC) versions 4.1 through 8, consider disabling the stack protect prologue and stack protect epilogue functions as a temporary workaround until a patch is available. Restrict access to the affected ARM targets to minimize the risk of exploitation. Avoid using the stack protector guard in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.