PT-2024-4418 · Clang+2 · Clang+2
Published
2024-02-01
·
Updated
2024-12-04
·
CVE-2024-31852
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
LLVM versions prior to 18.1.3
Description
The issue is related to a buffer overflow in memory when handling the LR register connection due to incorrect code generation management. This can lead to an exploitable error in the flow of control, potentially allowing a remote attacker to execute arbitrary code or cause a denial of service. The ARM backend is affected, and the issue can be demonstrated with Clang. The vendor notes that the likelihood of this miscompile enabling an exploit remains very low, as the miscompile resulting in this JOP gadget is likely to crash on most valid inputs to the function.
Recommendations
For versions prior to 18.1.3, update to version 18.1.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ARM backend to minimize the risk of exploitation. Additionally, ensure that any testing covers the affected functions to discover potential miscompiles before shipping binaries to production.
Fix
Code Injection
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Clang
Debian
Llvm