Resource exhaustion in llvm-project - CVE-2024-31852

Vulnerability identifier: #VU110231

CSH Severity: High

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-31852

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to LLVM generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

llvm-project
IBM Observability with Instana
Anolis OS
llvm
llvm-devel
llvm-googletest
llvm-libs
llvm-static
llvm-test
llvm-doc

Install updates from vendor's website.

llvm-project - update to 18.1.3
IBM Observability with Instana - update to 1.0.297
llvm - update to 17.0.6-7
llvm-devel - update to 17.0.6-7
llvm-googletest - update to 17.0.6-7
llvm-libs - update to 17.0.6-7
llvm-static - update to 17.0.6-7
llvm-test - update to 17.0.6-7
llvm-doc - update to 17.0.6-7

• https://bugs.chromium.org/p/llvm/issues/detail?id=69
• https://github.com/llvm/llvm-project/issues/80287
• https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
• https://llvm.org/docs/Security.html

• Resource exhaustion in llvm-project
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Anolis OS update for llvm