Memory Leak Vulnerability in Linux Kernel Affecting ARM64 Architecture

CVE-2024-57877

Summary

A vulnerability in the ARM64 architecture of the Linux kernel could lead to a memory exposure due to improper initialization of a temporary variable during the SETREGSET calls. When a zero-length SETREGSET call is made, uninitialized memory could be written back to target registers, allowing sensitive data (up to 64 bits) to be leaked from the kernel stack. This issue has been addressed by ensuring the temporary variable is initialized before any data is copied from userspace, thus mitigating the potential for data leakage.

References