Unscored severity · published Mar 17, 2008
CVE-2008-1367
gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction…
–
CVSS
2.8%
EPSS
No
On KEV
Description
gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Gcc · Gnu
4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1367
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469058
gcc.gnu.org
http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00417.html
gcc.gnu.org
http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00428.html
gcc.gnu.org
http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00432.html
gcc.gnu.org
http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00499.html
git.kernel.org
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40cd10ccff3d9fbffd57b93780bee4b7b9bff51
More from Gcc
8.1
CVE-2018-12886
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction…
7.8
CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c
7.8
CVE-2002-2439
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts
7.5
CVE-2019-15847
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy…
6.5
CVE-2021-3826
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a…