cpp-12: **DISPUTED**A failure in the -fstack-protector feature in GCC-basedtoolchainsthat target AArch64 allows an attacker t...

**DISPUTED**A failure in the -fstack-protector feature in GCC-basedtoolchainsthat target AArch64 allows an attacker to exploit an existing bufferoverflow in dynamically-sized local variables in your applicationwithout this being detected. This stack-protector failure only appliesto C99-style dynamically-sized local variables or those created usingalloca(). The stack-protector operates as intended for statically-sizedlocal variables.The default behavior when the stack-protectordetects an overflow is to terminate your application, resulting incontrolled loss of availability. An attacker who can exploit a bufferoverflow without triggering the stack-protector might be able to changeprogram flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC projectargues that this is a missed hardening bug and not a vulnerability byitself.

Where it's fixed