CVE-2024-57877 (GCVE-0-2024-57877)
Vulnerability from cvelistv5
Published
2025-01-11 14:49
Modified
2025-05-04 10:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_POE Currently poe_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently an arbitrary value will be written back to target->thread.por_el0, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing contents of POR_EL1 will be retained. Before this patch: | # ./poe-test | Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d | SETREGSET(nt=0x40f, len=8) wrote 8 bytes | | Attempting to read NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) read 8 bytes | Read NT_ARM_POE::por_el0 = 0x900d900d900d900d | | Attempting to write NT_ARM_POE (zero length) | SETREGSET(nt=0x40f, len=0) wrote 0 bytes | | Attempting to read NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) read 8 bytes | Read NT_ARM_POE::por_el0 = 0xffff8000839c3d50 After this patch: | # ./poe-test | Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d | SETREGSET(nt=0x40f, len=8) wrote 8 bytes | | Attempting to read NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) read 8 bytes | Read NT_ARM_POE::por_el0 = 0x900d900d900d900d | | Attempting to write NT_ARM_POE (zero length) | SETREGSET(nt=0x40f, len=0) wrote 0 bytes | | Attempting to read NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) read 8 bytes | Read NT_ARM_POE::por_el0 = 0x900d900d900d900d
References
Impacted products
Vendor Product Version
Linux Linux Version: 17519819926211e6b2834e00e4554bec0daf22ac
Version: 17519819926211e6b2834e00e4554bec0daf22ac
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/ptrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4105dd76bc8ad6529d47157ef0565cb84ca6676c",
              "status": "affected",
              "version": "17519819926211e6b2834e00e4554bec0daf22ac",
              "versionType": "git"
            },
            {
              "lessThan": "594bfc4947c4fcabba1318d8384c61a29a6b89fb",
              "status": "affected",
              "version": "17519819926211e6b2834e00e4554bec0daf22ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/ptrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_POE\n\nCurrently poe_set() doesn\u0027t initialize the temporary \u0027ctrl\u0027 variable,\nand a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently an arbitrary value will be written back to\ntarget-\u003ethread.por_el0, potentially leaking up to 64 bits of memory from\nthe kernel stack. The read is limited to a specific slot on the stack,\nand the issue does not provide a write mechanism.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\ncontents of POR_EL1 will be retained.\n\nBefore this patch:\n\n| # ./poe-test\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_POE (zero length)\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0xffff8000839c3d50\n\nAfter this patch:\n\n| # ./poe-test\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_POE (zero length)\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T10:05:40.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4105dd76bc8ad6529d47157ef0565cb84ca6676c"
        },
        {
          "url": "https://git.kernel.org/stable/c/594bfc4947c4fcabba1318d8384c61a29a6b89fb"
        }
      ],
      "title": "arm64: ptrace: fix partial SETREGSET for NT_ARM_POE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57877",
    "datePublished": "2025-01-11T14:49:03.297Z",
    "dateReserved": "2025-01-11T14:45:42.023Z",
    "dateUpdated": "2025-05-04T10:05:40.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57877\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T15:15:08.063\",\"lastModified\":\"2025-02-03T14:57:09.220\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: ptrace: fix partial SETREGSET for NT_ARM_POE\\n\\nCurrently poe_set() doesn\u0027t initialize the temporary \u0027ctrl\u0027 variable,\\nand a SETREGSET call with a length of zero will leave this\\nuninitialized. Consequently an arbitrary value will be written back to\\ntarget-\u003ethread.por_el0, potentially leaking up to 64 bits of memory from\\nthe kernel stack. The read is limited to a specific slot on the stack,\\nand the issue does not provide a write mechanism.\\n\\nFix this by initializing the temporary value before copying the regset\\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\\ncontents of POR_EL1 will be retained.\\n\\nBefore this patch:\\n\\n| # ./poe-test\\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\\n|\\n| Attempting to read NT_ARM_POE::por_el0\\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\\n|\\n| Attempting to write NT_ARM_POE (zero length)\\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\\n|\\n| Attempting to read NT_ARM_POE::por_el0\\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\\n| Read NT_ARM_POE::por_el0 = 0xffff8000839c3d50\\n\\nAfter this patch:\\n\\n| # ./poe-test\\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\\n|\\n| Attempting to read NT_ARM_POE::por_el0\\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\\n|\\n| Attempting to write NT_ARM_POE (zero length)\\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\\n|\\n| Attempting to read NT_ARM_POE::por_el0\\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: ptrace: correcci\u00f3n de SETREGSET parcial para NT_ARM_POE Actualmente, poe_set() no inicializa la variable temporal \u0027ctrl\u0027, y una llamada a SETREGSET con una longitud de cero la dejar\u00e1 sin inicializar. En consecuencia, se volver\u00e1 a escribir un valor arbitrario en target-\u0026gt;thread.por_el0, lo que podr\u00eda provocar una fuga de hasta 64 bits de memoria de la pila del kernel. La lectura est\u00e1 limitada a una ranura espec\u00edfica en la pila, y el problema no proporciona un mecanismo de escritura. Corrija esto inicializando el valor temporal antes de copiar el conjunto de registros desde el espacio de usuario, como para otros conjuntos de registros (por ejemplo, NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). En el caso de una escritura de longitud cero, se conservar\u00e1n los contenidos existentes de POR_EL1. Antes de este parche: | # ./poe-test | Intentando escribir NT_ARM_POE::por_el0 = 0x900d900d900d900d | SETREGSET(nt=0x40f, len=8) escribi\u00f3 8 bytes | | Intentando leer NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) ley\u00f3 8 bytes | Le\u00eddo NT_ARM_POE::por_el0 = 0x900d900d900d900d | | Intentando escribir NT_ARM_POE (longitud cero) | SETREGSET(nt=0x40f, len=0) escribi\u00f3 0 bytes | | Intentando leer NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) ley\u00f3 8 bytes | Leer NT_ARM_POE::por_el0 = 0xffff8000839c3d50 Despu\u00e9s de este parche: | # ./poe-test | Intentando escribir NT_ARM_POE::por_el0 = 0x900d900d900d900d | SETREGSET(nt=0x40f, len=8) escribi\u00f3 8 bytes | | Intentando leer NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) ley\u00f3 8 bytes | Leer NT_ARM_POE::por_el0 = 0x900d900d900d900d | | Intentando escribir NT_ARM_POE (longitud cero) | SETREGSET(nt=0x40f, len=0) escribi\u00f3 0 bytes | | Intentando leer NT_ARM_POE::por_el0 | GETREGSET(nt=0x40f, len=8) leer 8 bytes | Leer NT_ARM_POE::por_el0 = 0x900d900d900d900d\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"2AF25791-E5D9-498F-AEA3-261AE0D30C3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4105dd76bc8ad6529d47157ef0565cb84ca6676c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/594bfc4947c4fcabba1318d8384c61a29a6b89fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.