CVE-2024-57877

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: ptrace: fix partial SETREGSET for NT_ARM_POE

Currently poe_set() doesn't initialize the temporary 'ctrl' variable,

and a SETREGSET call with a length of zero will leave this

uninitialized. Consequently an arbitrary value will be written back to

target->thread.por_el0, potentially leaking up to 64 bits of memory from

the kernel stack. The read is limited to a specific slot on the stack,

and the issue does not provide a write mechanism.

Fix this by initializing the temporary value before copying the regset

from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,

NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing

contents of POR_EL1 will be retained.

Before this patch:

| # ./poe-test

| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d

| SETREGSET(nt=0x40f, len=8) wrote 8 bytes

|

| Attempting to read NT_ARM_POE::por_el0

| GETREGSET(nt=0x40f, len=8) read 8 bytes

| Read NT

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References