CVE-2024-57878: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57878 affects the Linux kernel's arm64 ptrace functionality. The vulnerability was discovered in the SETREGSET handling for NTARMFPMR, where the fpmr_set() function fails to initialize a temporary variable. The issue affects Linux kernel versions from 6.9 through 6.12.5 and version 6.13-rc1 (NVD).

The vulnerability stems from the fpmr_set() function not initializing the temporary 'fpmr' variable before use. When a SETREGSET call is made with a length of zero, the uninitialized variable is used, resulting in an arbitrary value being written back to target->thread.uw.fpmr. This can lead to leaking up to 64 bits of memory from the kernel stack. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (NVD).

The vulnerability allows for potential exposure of kernel memory contents, specifically up to 64 bits of data from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism (Kernel Patch).

The vulnerability has been fixed by initializing the temporary value before copying the regset from userspace, similar to other regsets (e.g., NTPRSTATUS, NTPRFPREG, NTARMSYSTEM_CALL). In the case of a zero-length write, the existing contents of FPMR will be retained. The fix is included in Linux kernel version 6.12.5 and later (Kernel Patch).