PT-2025-3602 · Linux+1 · Linux Kernel+1

Mark Rutland · Published 2024-12-05 · Updated 2025-09-29 · CVE-2024-57877

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the Linux kernel's ptrace functionality, specifically with the arm64 architecture. The problem arises when the poe set() function does not initialize a temporary variable, leading to potential memory leaks of up to 64 bits from the kernel stack when a SETREGSET call with a length of zero is made. This can result in arbitrary values being written back to target->thread.por el0. The read is limited to a specific slot on the stack, and there is no write mechanism provided by the issue. The fix involves initializing the temporary value before copying the regset from userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALSA-2025_16880

ALT-PU-2024-17881

BDU:2025-04465

CVE-2024-57877

Affected Products

Alt Linux

Linux Kernel

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57877.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-57877 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20480.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57877 · Vendor Advisory
• https://git.kernel.org/stable/c/4105dd76bc8ad6529d47157ef0565cb84ca6676c · Patch
• https://osv.dev/vulnerability/BELL-CVE-2024-57877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-57877 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20530.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-57877 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04465 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57877 · Security Note
• https://git.kernel.org/stable/c/594bfc4947c4fcabba1318d8384c61a29a6b89fb · Patch
• https://osv.dev/vulnerability/CVE-2024-57877 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-57877 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2024-57877 · Note