CVE-2024-57874

What it actually does

Uninitialized 'ctrl' variable in tagged_addr_ctrl_set() for NT_ARM_TAGGED_ADDR_CTRL regset on arm64 allows a zero-length SETREGSET ptrace call to read and return up to 64 bits of arbitrary kernel stack memory; exposure is limited to reads with no write capability and is further constrained by set_tagged_addr_ctrl() validation.

Why it matters to the business

Low-risk kernel memory disclosure on arm64 Linux systems could leak limited sensitive values that aid attackers in crafting further exploits; the issue affects a narrow ptrace interface and has no known active exploitation or ransomware use, reducing operational urgency despite the long publication window.

How an attack unfolds

An attacker with ptrace permissions on an arm64 task issues a partial regset write of length zero against NT_ARM_TAGGED_ADDR_CTRL; the uninitialized stack value is passed to set_tagged_addr_ctrl() which may succeed or fail depending on the random data, returning kernel stack contents to user space when it succeeds.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that initializes the temporary ctrl variable before copying the regset; for the listed chromium-browser packages on Ubuntu 14.04 LTS apply the referenced fixed build 58.0.3029.81-0ubuntu0.14.04.1172 or later.

How to confirm the fix worked

Confirm the patched kernel source contains initialization of the ctrl variable prior to copy_regset_from_user in tagged_addr_ctrl_set(); verify running kernel version matches or exceeds the fixed release and test that zero-length SETREGSET calls retain the prior tagged address control value without leakage.

Typical attack path

1. Obtain ptrace capability against a target arm64 process
2. Invoke PTRACE_SETREGSET with NT_ARM_TAGGED_ADDR_CTRL and a zero-length buffer
3. Receive the returned regset containing up to 64 bits of uninitialized kernel stack
4. Parse leaked bits for useful addresses, cookies, or other values to support follow-on attacks

How to detect it

Review ptrace-related audit logs and kernel stack traces for unexpected NT_ARM_TAGGED_ADDR_CTRL regset operations; monitor for processes issuing zero-length SETREGSET calls on arm64 tasks and correlate with any anomalous returns from get_tagged_addr_ctrl.

What your security team should do

• Prioritize kernel updates on all arm64 systems even though EPSS remains low and KEV status is false
• Audit any custom ptrace or regset handling code for similar uninitialized-variable patterns
• Add the supplied WARN_ON_ONCE checks if backporting the fix to older kernels