CVE-2024-31852MediumCVSS 5.9

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So if this function is covered by any testing the miscompile is most likely to be discovered before the binary is shipped to production."

Published
June 30, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-31852 →

📋 Description

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

🎯 Affected products17

  • azl3 clang 18.1.2-2 on Azure Linux 3.0
  • azl3 clang 18.1.2-4 on Azure Linux 3.0
  • azl3 compiler-rt 18.1.2-2 on Azure Linux 3.0
  • azl3 compiler-rt 18.1.2-3 on Azure Linux 3.0
  • azl3 libcxx 18.1.2-3 on Azure Linux 3.0
  • azl3 lld 18.1.2-2 on Azure Linux 3.0
  • azl3 lld 18.1.2-3 on Azure Linux 3.0
  • azl3 lldb 18.1.2-2 on Azure Linux 3.0
  • azl3 llvm 18.1.2-3 on Azure Linux 3.0
  • azl3 llvm 18.1.2-4 on Azure Linux 3.0
  • azl3 rust 1.75.0-14 on Azure Linux 3.0
  • azl3 rust 1.75.0-9 on Azure Linux 3.0
  • azl3 rust 1.86.0-1 on Azure Linux 3.0
  • cbl2 clang16 16.0.0-1 on CBL Mariner 2.0
  • cbl2 rust 1.72.0-10 on CBL Mariner 2.0
  • cbl2 rust 1.72.0-10 on CBL-Mariner 2.0
  • cbl2 rust 1.72.0-8 on CBL Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 1.72.0-8 KBCBL-Mariner Releases (Security Update) — fixed build 16.0.0-1 KBCBL-Mariner Releases (Security Update) — fixed build 18.1.2-3 KBCBL-Mariner Releases (Security Update) — fixed build 18.1.2-2 KBCBL-Mariner Releases (Security Update) — fixed build 1.75.0-9 KBCBL-Mariner Releases (Security Update)

🔗 References (2)