CVE-2024-57878

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR<br /> <br /> Currently fpmr_set() doesn&amp;#39;t initialize the temporary &amp;#39;fpmr&amp;#39; variable,<br /> and a SETREGSET call with a length of zero will leave this<br /> uninitialized. Consequently an arbitrary value will be written back to<br /> target-&gt;thread.uw.fpmr, potentially leaking up to 64 bits of memory from<br /> the kernel stack. The read is limited to a specific slot on the stack,<br /> and the issue does not provide a write mechanism.<br /> <br /> Fix this by initializing the temporary value before copying the regset<br /> from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,<br /> NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing<br /> contents of FPMR will be retained.<br /> <br /> Before this patch:<br /> <br /> | # ./fpmr-test<br /> | Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d<br /> | SETREGSET(nt=0x40e, len=8) wrote 8 bytes<br /> |<br /> | Attempting to read NT_ARM_FPMR::fpmr<br /> | GETREGSET(nt=0x40e, len=8) read 8 bytes<br /> | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d<br /> |<br /> | Attempting to write NT_ARM_FPMR (zero length)<br /> | SETREGSET(nt=0x40e, len=0) wrote 0 bytes<br /> |<br /> | Attempting to read NT_ARM_FPMR::fpmr<br /> | GETREGSET(nt=0x40e, len=8) read 8 bytes<br /> | Read NT_ARM_FPMR::fpmr = 0xffff800083963d50<br /> <br /> After this patch:<br /> <br /> | # ./fpmr-test<br /> | Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d<br /> | SETREGSET(nt=0x40e, len=8) wrote 8 bytes<br /> |<br /> | Attempting to read NT_ARM_FPMR::fpmr<br /> | GETREGSET(nt=0x40e, len=8) read 8 bytes<br /> | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d<br /> |<br /> | Attempting to write NT_ARM_FPMR (zero length)<br /> | SETREGSET(nt=0x40e, len=0) wrote 0 bytes<br /> |<br /> | Attempting to read NT_ARM_FPMR::fpmr<br /> | GETREGSET(nt=0x40e, len=8) read 8 bytes<br /> | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d