CVE-2024-57878

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR

Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable,

and a SETREGSET call with a length of zero will leave this

uninitialized. Consequently an arbitrary value will be written back to

target->thread.uw.fpmr, potentially leaking up to 64 bits of memory from

the kernel stack. The read is limited to a specific slot on the stack,

and the issue does not provide a write mechanism.

Fix this by initializing the temporary value before copying the regset

from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,

NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing

contents of FPMR will be retained.

Before this patch:

| # ./fpmr-test

| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d

| SETREGSET(nt=0x40e, len=8) wrote 8 bytes

|

| Attempting to read NT_ARM_FPMR::fpmr

| GETREGSET(nt=0x40e, len=8) read 8 bytes

| Read NT_ARM

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References