CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's arm64 architecture, specifically in the ptrace system, where the 'orig_x0' register does not remain synchronized with the 'x0' register during syscall entry. This oversight allows a tracer to manipulate syscall arguments without proper seccomp or audit checks, potentially leading to unauthorized access or manipulation of system calls. Organizations using Linux on arm64 architecture should prioritize addressing this issue to mitigate risks associated with syscall tracing and maintain system integrity.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates") attempted to resolve a long-standing issue with syscall entry tracing, where a tracer is able to manipulate the first syscall argument without being subjected to seccomp or audit checking. Unfortunately, that fix was incomplete [1], as it failed to update 'orig_x0' between a tracer updating x0 during a seccomp ptrace exit (SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated. Rather than add hooks to the core seccomp code, instead move the synchronisation code into the ptrace GPR and syscall setting code so that 'orig_x0' is kept up to date with x0 whenever we're stopped on the syscall entry path.