CVE-2017-1000376

libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.

libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.

libffi, a library used to call code written in one language from code written in a different language, was enforcing an executable stack on the i386 architecture. While this might not be considered a vulnerability by itself, this could be leveraged when exploiting other vulnerabilities, such as the "stack clash" class of vulnerabilities discovered by Qualys Research Labs.

This update for gcc43 fixes the following issues:

Security issue fixed:

• CVE-2017-1000376: Don't request excutable stack from libffi. [bnc#1045091]

New features:

• Add support for retpolines to mitigate the Spectre Variant 2 attack. [bnc#1074621]
• Add support for zero-sized VLAs and allocas with -fstack-clash-protection. [bnc#1059075]
• Add support for -fstack-clash-protection to mitigate the Stack Clash attack. [bnc#1039513]

Non security bugs fixed:

• Fixed build of 32bit libgcov.a with LFS support. [bsc#1044016]
• Fixed issue with libstdc++ functional when an exception is thrown during construction. [bsc#999596]
• Fixed issue with using gcov and #pragma pack. [bsc#977654]
• Fixed ICE compiling AFS modules for the s390x kernel. [bsc#938159]
• Backport large file support from GCC 4.6.

It was discovered that libffi incorrectly enforced an executable stack. An attacker could possibly use this issue, in combination with another vulnerability, to facilitate executing arbitrary code.