CVE-2024-57878: arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: fix partial SETREGSET for NTARMFPMR
Currently fpmrset() doesn't initialize the temporary 'fpmr' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently an arbitrary value will be written back to target->thread.uw.fpmr, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism.
Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NTPRSTATUS, NTPRFPREG, NTARMSYSTEMCALL). In the case of a zero-length write, the existing contents of FPMR will be retained.
Before this patch:
| # ./fpmr-test | Attempting to write NTARMFPMR::fpmr = 0x900d900d900d900d | SETREGSET(nt=0x40e, len=8) wrote 8 bytes | | Attempting to read NTARMFPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NTARMFPMR::fpmr = 0x900d900d900d900d | | Attempting to write NTARMFPMR (zero length) | SETREGSET(nt=0x40e, len=0) wrote 0 bytes | | Attempting to read NTARMFPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NTARMFPMR::fpmr = 0xffff800083963d50
After this patch:
| # ./fpmr-test | Attempting to write NTARMFPMR::fpmr = 0x900d900d900d900d | SETREGSET(nt=0x40e, len=8) wrote 8 bytes | | Attempting to read NTARMFPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NTARMFPMR::fpmr = 0x900d900d900d900d | | Attempting to write NTARMFPMR (zero length) | SETREGSET(nt=0x40e, len=0) wrote 0 bytes | | Attempting to read NTARMFPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NTARMFPMR::fpmr = 0x900d900d900d900d
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57878?
CVE-2024-57878 is considered to have a moderate severity level due to its potential impact on the functionality of the Linux kernel.
How do I fix CVE-2024-57878?
To fix CVE-2024-57878, update your Linux kernel to version 6.12.5 or higher.
Which versions of the Linux kernel are affected by CVE-2024-57878?
CVE-2024-57878 affects Linux kernel versions from 6.9 up to 6.12.5, including a specific instance in 6.13-rc1.
What is the nature of the vulnerability in CVE-2024-57878?
CVE-2024-57878 involves a flaw in the ptrace functionality, specifically a failure to initialize a variable which can lead to potential issues.
Who reported CVE-2024-57878?
The details for CVE-2024-57878 were resolved and reported by contributors to the Linux kernel development community.