CVE-2023-4039

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains <br /> that target AArch64 allows an attacker to exploit an existing buffer <br /> overflow in dynamically-sized local variables in your application <br /> without this being detected. This stack-protector failure only applies <br /> to C99-style dynamically-sized local variables or those created using <br /> alloca(). The stack-protector operates as intended for statically-sized <br /> local variables.<br /> <br /> The default behavior when the stack-protector <br /> detects an overflow is to terminate your application, resulting in <br /> controlled loss of availability. An attacker who can exploit a buffer <br /> overflow without triggering the stack-protector might be able to change <br /> program flow control to cause an uncontrolled loss of availability or to<br /> go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.