CVE-2024-31852: 
CBL Mariner vulnerability analysis and mitigation

LLVM before version 18.1.3 contains a vulnerability where the LR (Link Register) register can be overwritten without data being saved to the stack, potentially leading to exploitable control flow errors. This vulnerability affects the ARM backend and can be demonstrated using Clang. The issue was discovered in early 2024 and tracked as CVE-2024-31852 (NVD).

The vulnerability occurs in the ARM backend where code generation incorrectly handles the LR register. Specifically, the compiler generates code that overwrites the LR register without first saving its data on the stack, which can lead to corrupted control flow. The issue has been assigned a CVSS v3.1 base score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, LLVM Issue).

When exploited, this vulnerability can lead to corrupted control flow in compiled programs. However, according to the vendor, the likelihood of this miscompilation enabling an exploit remains very low, as the affected function is likely to crash on most valid inputs, making it probable that the issue would be discovered during testing before production deployment (NVD).

The vulnerability requires specific conditions in the ARM backend code generation process. While technically exploitable, the vendor notes that the miscompilation resulting in this Jump-Oriented Programming (JOP) gadget typically causes the function to crash on valid inputs, making successful exploitation challenging (NVD, LLVM Issue).

The issue has been fixed in LLVM version 18.1.3. The fix involves updating the IsRestored flag for LR based on all returns in the function, not just individual instructions. A patch has been committed that addresses the incorrect handling of the LR register (LLVM Commit).