CVE-2023-4039

CVE-2023-4039 describes a disputed vulnerability in GCC-based toolchains targeting AArch64, where the -fstack-protector feature fails to detect buffer overflows in dynamically-sized local variables (C99-style or alloca()). This allows an attacker to exploit such overflows without triggering the stack-protector, potentially leading to uncontrolled loss of availability, or affecting confidentiality and integrity. The vulnerability has a CVSS score of 4.8 (MEDIUM), indicating a network attack vector with high attack complexity and low impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, no public exploit code, and minimal community discussion, though it was mentioned on Reddit.