CVE-2024-7883

What it actually does

Secure stack contents leak to Non-secure state via floating-point registers on Secure-to-Non-secure function returns that produce FP values when FP has not been used since entering Secure state; limited to LLVM-generated code using CMSE.

Why it matters to the business

Confidentiality exposure of limited secure-state data on affected embedded or Linux systems using vulnerable LLVM toolchains; low urgency given stable low EPSS, no KEV listing, and dated publication.

How an attack unfolds

An attacker in Non-secure state invokes a secure function compiled with an affected LLVM version that returns a floating-point result; because it is the first FP operation after Secure entry, the compiler's register handling inadvertently copies Secure stack words into Non-secure-visible FP registers.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-68.111, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-lts-xenial 4.4.0-13.29~14.04.1, linux 4.2.0-19.23, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-snapdragon 4.4.0-1012.12, linux-lts-utopic 3.16.0-53.72~14.04.1, linux-lts-vivid 3.19.0-33.38~14.04.1, linux-lts-wily 4.2.0-18.22~14.04.1.

How to confirm the fix worked

Verify package versions match the fixed releases above; recompile CMSE code with updated LLVM and confirm absence of the register-leak pattern on first FP return.

Typical attack path

1. Identify a Secure-to-Non-secure call site returning FP value in LLVM-generated CMSE code
2. Trigger the call as the first FP use after entering Secure state
3. Read leaked Secure stack contents from Non-secure FP registers

How to detect it

No runtime artifacts are produced by the leak itself; review build logs and compiler versions used for CMSE firmware to determine whether vulnerable code was generated.

What your security team should do

• Apply the kernel package upgrades immediately on all listed Ubuntu releases
• Audit any custom CMSE code built with LLVM for the described return pattern
• Monitor EPSS and KEV updates for any future increase in exploit activity