Linux Kernel Vulnerability in ARM64 PTRACE Functionality

CVE-2024-57874

Summary

A security vulnerability exists within the Linux kernel's ARM64 ptrace functionality where an uninitialized variable in the tagged_addr_ctrl_set() method can lead to unintended memory exposure. Specifically, a partial SETREGSET call with a length of zero can leak up to 64 bits of kernel stack memory. This vulnerability does not allow for a write operation, thus limiting the potential impact. Proper initialization of the temporary variable prior to the copying operation from userspace has been implemented in the fix, addressing the issue effectively while ensuring existing values are retained during zero-length writes.

References