CVE-2024-57874

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case.

• CWE-908
• CWE-908

• https://git.kernel.org/stable/c/1152dd13845efde5554f80c7e1233bae1d26bd3ePatch
• https://git.kernel.org/stable/c/1370cf3eb5495d70e00547598583a4cd45b40b99Patch
• https://git.kernel.org/stable/c/1c176f5155ee6161fee6f416b64aa50394d3f220Patch
• https://git.kernel.org/stable/c/96035c0093db258975b8887676afe59a64c34a72Patch
• https://git.kernel.org/stable/c/abd614bbfcee73247495bd9472da8f85ac83546ePatch
• https://git.kernel.org/stable/c/ca62d90085f4af36de745883faab9f8a7cbb45d3Patch
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Published

Jan 11, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-57854Net::NSCA::Client versions through 0.009002 for Perl uses a …9.1
• CVE-2024-57857In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-5786Cross-Site Request Forgery vulnerability in Comtrend router …6.5
• CVE-2024-57868Web::API 2.8 and earlier for Perl uses the rand() function a…5.5
• CVE-2024-5787The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-57872In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-57875In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-57876In the Linux kernel, the following vulnerability has been re…7
• CVE-2024-57877In the Linux kernel, the following vulnerability has been re…6.1
• CVE-2024-57878In the Linux kernel, the following vulnerability has been re…6.1
• CVE-2024-57879In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-5788The Silesia theme for WordPress is vulnerable to Stored Cros…6.4