5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-31852

CVE-2024-31852: LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being...

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-31852

CVE-2024-31852:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2024-31852 describes a situation where LLVM's ARM backend generates code where the Link Register (LR) can be overwritten because it wasn't properly saved to the stack. This is due to a miscompilation. The provided commit 0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2 addresses this issue.

The analysis of the commit reveals that the core of the problem lay within the ARMLoadStoreOptimizer.

The function llvm::ARMLoadStoreOpt::MergeReturnIntoLDM previously contained logic that would incorrectly mark the LR as not needing to be restored (Info.setRestored(false)) based on a local optimization. This logic was removed in the patch, indicating it was faulty.
The main pass function llvm::ARMLoadStoreOpt::runOnMachineFunction calls MergeReturnIntoLDM. Before the patch, it didn't ensure that the LR's restoration status was globally correct after such optimizations. The patch introduces a call to a new function ARMFrameLowering::updateLRRestored (which correctly determines LR restoration status based on all return instructions) if MergeReturnIntoLDM modified any return instructions.

These two functions in ARMLoadStoreOptimizer.cpp are identified as vulnerable because their pre-patch logic directly contributed to the incorrect assessment of whether LR needed to be saved, leading to the generation of faulty code where LR could be clobbered. The functions in ARMFrameLowering.cpp were modified to introduce the fix (updateLRRestored) and to call this fix, but the origin of the incorrect state was the optimizer.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.