Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code.

When someone tries to compile that source code using a particular compiler version the compilation results in some exploit that infects the target machine.

I'm not searching for toy examples or just research papers, but actually for something documented that affected at least some machine with a real payload.

I know theoretically that this is possible, but I'm curious if this has ever been a real issue for someone.


Yes, take a look at the change log of gcc, llvm, etc, although practical examples are rare. IIRC I have seen at least two practical PoC's one was for java and the other a c compiler. If you extend the concept of a compilation to include jit you can find many more eaxmples in javascript, ruby (https://www.cvedetails.com/vulnerability-list/vendor_id-7252/opov-1/Ruby-lang.html) or the php engine (http://www.php-security.org/) to mention some.

There is also an issue of compilers introducing vulnerabilities into the compiled binary that may not exist in the source code through optimisation. The first example that comes to mind is this linux kernel exploit from a few years back: https://isc.sans.edu/forums/diary/A+new+fascinating+Linux+kernel+vulnerability/6820/ where compiler optimisation removed a check that would have prevented the vulnerability in the first place.

CERT cover some various examples of code that may get optimised into being insecure over at: https://www.securecoding.cert.org/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.