CVE-2023-4039: ARM64 GCC

[Markus Ueberall]

See https://launchpad.net/ubuntu/+source/gcc-10/10.5.0-3ubuntu1/+build/27746786/+files/buildlog_ubuntu-noble-arm64.gcc-10_10.5.0-3ubuntu1_BUILDING.txt.gz

The above build is supposed to address https://nvd.nist.gov/vuln/detail/CVE-2023-4039

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Rama malladi (rvmallad)]

Can we have this issue (https://ubuntu.com/security/CVE-2023-4039) fixed by patching all the version of GCC supported in Ubuntu releases? Thank you. It impacts `aarch64` based processors such as AWS Graviton.

[Rama malladi (rvmallad)]

Here are the technical details of this issue and the GCC patches to fix it:
https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64#Technical-Specifications

[Matthias Klose (doko)]

GCC 10 is not a default compiler in any LTS release.

[Julian Andres Klode (juliank)]

gcc-10 is shipped in focal main so it needs a security fix there; we should probably address the fix in gcc-10 in noble as well.

For other releases, gcc-10 is in universe, and fixes for it can be landed via esm-apps-security in Ubuntu Pro.

[Julian Andres Klode (juliank)]

doko: Should we consider splitting the bug into the FTBFS on noble in this one and a separate one for the CVE itself?

[Matthias Klose (doko)]

fixed in noble

[gerald.yang (gerald-yang-tw)]

I have organized the affected GCC version on Focal, Jammy and Noble.

All GCC versions (10, 11, 12, 13) on Noble already include the fix.

Could we also backport the fix to GCC versions on Jammy and Focal?
At least GCC-9 is in main on Focal and GCC-11 is in main on Jammy.

Thanks,
Gerald

[gerald.yang (gerald-yang-tw)]

The patches can be found here (re-post from comment #3):
https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64#Technical-Specifications

[gerald.yang (gerald-yang-tw)]

Hi Matthias,

Could you help to take a look into this backport for focal and jammy? really appreciate!

Thanks,
Gerald

[Mauricio Faria de Oliveira (mfo)]

Working on it; have test builds for gcc-12/11/10/9 on jammy and gcc-10/9 on focal
(following the changes/process used in gcc-N packages to add the patch, similarly).
Currently going through autopkgtests, and one unrelated (Ada?) FTBFS, being looked.

[Mauricio Faria de Oliveira (mfo)]

Apparently, cannot target gcc-9 to Jammy/Focal, not even by going to the edit status link/page manually.

[Mauricio Faria de Oliveira (mfo)]

gcc-12 fixed in 12.3.0-9, already in Mantic/Noble/Oracular (devel).

gcc-12 (12.3.0-9) unstable; urgency=medium

    - Address stack protector and stack clash protection weaknesses
      on AArch64. CVE-2023-4039.

$ rmadison -a source gcc-12
 gcc-12 | 12-20220319-1ubuntu1 | jammy | source
 gcc-12 | 12.3.0-1ubuntu1~22.04 | jammy-security | source
 gcc-12 | 12.3.0-1ubuntu1~22.04 | jammy-updates | source
 gcc-12 | 12.3.0-9ubuntu2 | mantic | source
 gcc-12 | 12.3.0-17ubuntu1 | noble/universe | source
 gcc-12 | 12.3.0-17ubuntu1 | oracular/universe | source

[Mauricio Faria de Oliveira (mfo)]

Similarly for gcc-11 (11.4.0-4 in Mantic/Noble/Oracular).

gcc-11 (11.4.0-4) unstable; urgency=medium

    - Address stack protector and stack clash protection weaknesses
      on AArch64. CVE-2023-4039.

$ rmadison -a source gcc-11
 gcc-11 | 11.2.0-19ubuntu1 | jammy | source
 gcc-11 | 11.4.0-1ubuntu1~22.04 | jammy-security | source
 gcc-11 | 11.4.0-1ubuntu1~22.04 | jammy-updates | source
 gcc-11 | 11.4.0-4ubuntu1 | mantic | source
 gcc-11 | 11.4.0-9ubuntu1 | noble/universe | source
 gcc-11 | 11.4.0-9ubuntu1 | oracular/universe | source

[Mauricio Faria de Oliveira (mfo)]

Similarly for gcc-10 (10.5.0-4 in Noble/Oracular).

gcc-10 (10.5.0-4) unstable; urgency=medium

  * Fix ftbfs on AArch64 in previous upload.

gcc-10 (10.5.0-3) unstable; urgency=medium

  * Address stack protector and stack clash protection weaknesses
    on AArch64. CVE-2023-4039. Taken from the gcc-11 branch.

$ rmadison -a source gcc-10
 gcc-10 | 10-20200411-0ubuntu1 | focal | source
 gcc-10 | 10.3.0-15ubuntu1 | jammy/universe | source
 gcc-10 | 10.5.0-1ubuntu1~20.04 | focal-security | source
 gcc-10 | 10.5.0-1ubuntu1~20.04 | focal-updates | source
 gcc-10 | 10.5.0-1ubuntu1~22.04 | jammy-security/universe | source
 gcc-10 | 10.5.0-1ubuntu1~22.04 | jammy-updates/universe | source
 gcc-10 | 10.5.0-1ubuntu1 | mantic/universe | source
 gcc-10 | 10.5.0-4ubuntu2 | noble/universe | source
 gcc-10 | 10.5.0-4ubuntu2 | oracular/universe | source

[Mauricio Faria de Oliveira (mfo)]

Similarly for gcc-9 (9.5.0-6 in Noble/Oracular).

gcc-9 (9.5.0-6) unstable; urgency=medium

  * Address stack protector and stack clash protection weaknesses
    on AArch64. CVE-2023-4039.

$ rmadison -a source gcc-9
 gcc-9 | 9.3.0-10ubuntu2 | focal | source
 gcc-9 | 9.4.0-1ubuntu1~20.04.2 | focal-security | source
 gcc-9 | 9.4.0-1ubuntu1~20.04.2 | focal-updates | source
 gcc-9 | 9.4.0-1ubuntu1~20.04.3 | focal-proposed | source
 gcc-9 | 9.4.0-5ubuntu1 | jammy/universe | source
 gcc-9 | 9.5.0-1ubuntu1~22.04 | jammy-security/universe | source
 gcc-9 | 9.5.0-1ubuntu1~22.04 | jammy-updates/universe | source
 gcc-9 | 9.5.0-4ubuntu2 | mantic/universe | source
 gcc-9 | 9.5.0-6ubuntu2 | noble/universe | source
 gcc-9 | 9.5.0-6ubuntu2 | oracular/universe | source

[Mauricio Faria de Oliveira (mfo)]

(comment #12)
> Apparently, cannot target gcc-9 to Jammy/Focal, not even by going to the edit status link/page manually.

Added via LP API:

$ python3 -q
>>> cachedir = "/home/mfo/.launchpadlib/cache/"
>>> from launchpadlib.launchpad import Launchpad
>>> lp = Launchpad.login_with(..., 'production', cachedir, version='devel')
>>> bug=lp.bugs[2054343]
>>> bug.addTask(target='https://api.launchpad.net/devel/ubuntu/jammy/+source/gcc-9')
<bug_task at https://api.launchpad.net/devel/ubuntu/jammy/+source/gcc-9/+bug/2054343>
>>> bug.addTask(target='https://api.launchpad.net/devel/ubuntu/focal/+source/gcc-9')
<bug_task at https://api.launchpad.net/devel/ubuntu/focal/+source/gcc-9/+bug/2054343>