Conversation

Notices

1. Embed this notice
   Azeria (azeria@mastodon.social)'s status on Wednesday, 13-Sep-2023 09:26:14 JST Azeria

   Time for an Arm-twist! CVE-2023-4039

   Tom Hebb (Meta red team) and I discovered an 0day in GCC (for AArch64 targets) during my Arm exploitation training.

   It renders stack canaries against overflows of dynamically-sized variables useless.

   https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64

   • Embed this notice
     Kees Cook :tux: (kees@fosstodon.org)'s status on Wednesday, 13-Sep-2023 09:26:14 JST Kees Cook :tux:

     in reply to

     @Azeria I remain delighted that the Linux kernel eliminated VLAs back in 2018. :) I encourage everyone with a C codebase to build with -Wvla

     James Morris likes this.