Date: Mon, 22 Oct 2018 23:16:00 +0200 From: Florian Weimer <fweimer@...hat.com> To: Andrew Sandoval <ASandoval@...root.com> Cc: "oss-security\@lists.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions * Andrew Sandoval: > Will Webroot communicate this to the public? > Webroot believes in responsible disclosure and will work with third parties to > ensure that the vulnerability is addressed before a public announcement. We > are happy to work with your communications team on announcement timing. This is already public because oss-security is a public mailing list. Most GNU/Linux distributions ensure that only very special binaries (such as some versions of the Ada compiler) enable executable stacks. In our experience, if the toolchain produces a binary that requests an executable stack, it is more likely due to manually written assembler files without the required stack executability markup section, and not due to nested C functions whose address escapes. Without scanning built binaries for these discrepancies, such cases could easily be missed. Please also note that an executable stack is not a vulnerability itself, and it is not directly exploitable. (The same applies to the lack of Intel CET support in binaries.) Thanks, Florian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.