CVE-2024-31852

What it actually does

LLVM ARM backend miscompiles code such that the LR register can be clobbered without a prior stack save, creating a potential jump-oriented programming gadget that alters control flow.

Why it matters to the business

Organizations shipping ARM binaries risk silent introduction of control-flow errors that may cause application crashes or, in rare cases, allow an attacker to redirect execution; the defect affects any downstream product built with affected LLVM versions.

How an attack unfolds

An attacker supplies specially crafted source or IR to Clang that triggers the miscompile; the resulting binary contains an unsaved LR overwrite that, when combined with attacker-controlled data, forms a usable JOP sequence; exploitation remains difficult because most inputs cause an immediate crash rather than a stable gadget.

How to fix it

Upgrade llvm-project to a build containing commit c13b7485b87909fcf739f62cfa382b55407433c0 (or 0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2 for llvmbot forks) and rebuild all affected ARM targets; recompile and retest any previously compiled binaries.

How to confirm the fix worked

Confirm the updated LLVM revision is in use, rebuild a known-triggering test case, and verify that the generated assembly now contains a proper stack save of LR before any potential overwrite.

Typical attack path

1. Identify a function whose compilation triggers the LR miscompile in the ARM backend
2. Craft input that produces a binary containing the unsaved LR overwrite gadget
3. Combine the gadget with attacker-controlled memory or registers to redirect control flow
4. Trigger the vulnerable function with attacker-supplied data to achieve code execution or denial of service

How to detect it

Review build logs and binary analysis for functions compiled with pre-fix LLVM that exhibit LR clobber patterns; monitor runtime crashes in ARM binaries that occur on previously tested inputs after recompilation with older toolchains.

What your security team should do

• Immediately update all build pipelines to the fixed LLVM revision and rebuild ARM-targeted artifacts
• Add the miscompile test case to CI regression suites for ARM backends
• Prioritize rebuilds for any security-sensitive or network-facing ARM binaries