Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Oct 2018 20:31:02 +0000
From: Mikhail Klementev <>
Subject: Re: GCC Compiler Induced Vulnerability - affects
 programs compiled with GCC 7 and 8 containing nested functions


It was described in GCC documentation even from 2003:

What's difference between vulnerability you found and behavior that
was described in the documentation?

On Mon, Oct 22, 2018 at 03:07:55PM +0000, Andrew Sandoval wrote:
> ...
> Technical Description of the vulnerability
> When nested C functions are compiled by GCC, code is generated which causes the
> call stack of the currently executing thread to be made executable prior to the
> call to a nested function and for the duration of the thread's lifetime.  This
> is essentially the equivalent of disabling Data Execution Prevention (DEP).
> A stack overflow, etc., that is able to place instructions on the page(s) of
> memory made executable has the potential of gaining execution and running
> malware, etc.  This places the process at substantial risk of being exploited.
> ...

With eval and apply,
Mikhail Klementev.

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.