Detections
Analytics
Alpine: multiple g++ packages, multiple libatomic packages: security update to 13.2.1_git20231014-r0
medium Tenable Cloud Security Plugin ID 423912
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows
an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your
application without this being detected. This stack-protector failure only applies to C99-style
dynamically-sized local variables or those created using alloca(). The stack-protector operates as
intended for statically-sized local variables. The default behavior when the stack-protector detects an
overflow is to terminate your application, resulting in controlled loss of availability. An attacker who
can exploit a buffer overflow without triggering the stack-protector might be able to change program flow
control to cause an uncontrolled loss of availability or to go further and affect confidentiality or
integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by
itself. (CVE-2023-4039)
See Also
Plugin Details
Severity: Medium
ID: 423912
Version: Revision 1.9
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.1
Percentile: 53.34
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.1
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2023-4039
CVSS v3
Risk Factor: Medium
Base Score: 4.8
Temporal Score: 4.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/8/2023
Reference Information
CVE: CVE-2023-4039