GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47716 (GCVE-0-2024-47716)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:39
VLAI
Title
ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
Summary
In the Linux kernel, the following vulnerability has been resolved: ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6: BUG: unsupported FP instruction in kernel mode FPEXC == 0xc0000780 Internal error: Oops - undefined instruction: 0 [#1] ARM CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1 Hardware name: BCM2835 PC is at vfp_support_entry+0xc8/0x2cc LR is at do_undefinstr+0xa8/0x250 pc : [<c0101d50>] lr : [<c010a80c>] psr: a0000013 sp : dc8d1f68 ip : 60000013 fp : bedea19c r10: ec532b17 r9 : 00000010 r8 : 0044766c r7 : c0000780 r6 : ec532b17 r5 : c1c13800 r4 : dc8d1fb0 r3 : c10072c4 r2 : c0101c88 r1 : ec532b17 r0 : 0044766c Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 00c5387d Table: 0251c008 DAC: 00000051 Register r0 information: non-paged memory Register r1 information: vmalloc memory Register r2 information: non-slab/vmalloc memory Register r3 information: non-slab/vmalloc memory Register r4 information: 2-page vmalloc region Register r5 information: slab kmalloc-cg-2k Register r6 information: vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: non-paged memory Register r9 information: zero-size pointer Register r10 information: vmalloc memory Register r11 information: non-paged memory Register r12 information: non-paged memory Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b) Stack: (0xdc8d1f68 to 0xdc8d2000) 1f60: 0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0 1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010 1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000 Call trace: [<c0101d50>] (vfp_support_entry) from [<c010a80c>] (do_undefinstr+0xa8/0x250) [<c010a80c>] (do_undefinstr) from [<c0100f10>] (__und_usr+0x70/0x80) Exception stack(0xdc8d1fb0 to 0xdc8d1ff8) 1fa0: b6f68af8 00448fc0 00000000 bedea188 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception in interrupt ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- This is a minimal userspace reproducer on a Raspberry Pi Zero W: #include <stdio.h> #include <math.h> int main(void) { double v = 1.0; printf("%fn", NAN + *(volatile double *)&v); return 0; } Another way to consistently trigger the oops is: calvin@raspberry-pi-zero-w ~$ python -c "import json" The bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n, because the pr_debug() calls act as barriers even when not activated. This is the output from the same kernel source built with the same compiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as expected: VFP: bounce: trigger ec532b17 fpexc c0000780 VFP: emulate: INST=0xee377b06 SCR=0x00000000 VFP: bounce: trigger eef1fa10 fpexc c0000780 VFP: emulate: INST=0xeeb40b40 SCR=0x00000000 VFP: raising exceptions 30000000 calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer nan Crudely grepping for vmsr/vmrs instructions in the otherwise nearly idential text for vfp_support_entry() makes the problem obvious: vmlinux.llvm.good [0xc0101cb8] <+48>: vmrs r7, fpexc vmlinux.llvm.good [0xc0101cd8] <+80>: vmsr fpexc, r0 vmlinux.llvm.good [0xc0101d20 ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4708fb041346fa9cc6745dafb8c248a3e2f1075b , < 9fc60f2bdd43e758bdf0305c0fc83221419ddb3f (git)
Affected: 4708fb041346fa9cc6745dafb8c248a3e2f1075b , < cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b (git)
Affected: 4708fb041346fa9cc6745dafb8c248a3e2f1075b , < 39caf610a63786b3b0ef3348ac015edc19827d6a (git)
Affected: 4708fb041346fa9cc6745dafb8c248a3e2f1075b , < 89a906dfa8c3b21b3e5360f73c49234ac1eb885b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47716",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:02:37.747830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:18.288Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/vfp/vfpinstr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9fc60f2bdd43e758bdf0305c0fc83221419ddb3f",
              "status": "affected",
              "version": "4708fb041346fa9cc6745dafb8c248a3e2f1075b",
              "versionType": "git"
            },
            {
              "lessThan": "cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b",
              "status": "affected",
              "version": "4708fb041346fa9cc6745dafb8c248a3e2f1075b",
              "versionType": "git"
            },
            {
              "lessThan": "39caf610a63786b3b0ef3348ac015edc19827d6a",
              "status": "affected",
              "version": "4708fb041346fa9cc6745dafb8c248a3e2f1075b",
              "versionType": "git"
            },
            {
              "lessThan": "89a906dfa8c3b21b3e5360f73c49234ac1eb885b",
              "status": "affected",
              "version": "4708fb041346fa9cc6745dafb8c248a3e2f1075b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/vfp/vfpinstr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros\n\nFloating point instructions in userspace can crash some arm kernels\nbuilt with clang/LLD 17.0.6:\n\n    BUG: unsupported FP instruction in kernel mode\n    FPEXC == 0xc0000780\n    Internal error: Oops - undefined instruction: 0 [#1] ARM\n    CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1\n    Hardware name: BCM2835\n    PC is at vfp_support_entry+0xc8/0x2cc\n    LR is at do_undefinstr+0xa8/0x250\n    pc : [\u003cc0101d50\u003e]    lr : [\u003cc010a80c\u003e]    psr: a0000013\n    sp : dc8d1f68  ip : 60000013  fp : bedea19c\n    r10: ec532b17  r9 : 00000010  r8 : 0044766c\n    r7 : c0000780  r6 : ec532b17  r5 : c1c13800  r4 : dc8d1fb0\n    r3 : c10072c4  r2 : c0101c88  r1 : ec532b17  r0 : 0044766c\n    Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\n    Control: 00c5387d  Table: 0251c008  DAC: 00000051\n    Register r0 information: non-paged memory\n    Register r1 information: vmalloc memory\n    Register r2 information: non-slab/vmalloc memory\n    Register r3 information: non-slab/vmalloc memory\n    Register r4 information: 2-page vmalloc region\n    Register r5 information: slab kmalloc-cg-2k\n    Register r6 information: vmalloc memory\n    Register r7 information: non-slab/vmalloc memory\n    Register r8 information: non-paged memory\n    Register r9 information: zero-size pointer\n    Register r10 information: vmalloc memory\n    Register r11 information: non-paged memory\n    Register r12 information: non-paged memory\n    Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)\n    Stack: (0xdc8d1f68 to 0xdc8d2000)\n    1f60:                   0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0\n    1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010\n    1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000\n    Call trace:\n    [\u003cc0101d50\u003e] (vfp_support_entry) from [\u003cc010a80c\u003e] (do_undefinstr+0xa8/0x250)\n    [\u003cc010a80c\u003e] (do_undefinstr) from [\u003cc0100f10\u003e] (__und_usr+0x70/0x80)\n    Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)\n    1fa0:                                     b6f68af8 00448fc0 00000000 bedea188\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff\n    Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)\n    ---[ end trace 0000000000000000 ]---\n    Kernel panic - not syncing: Fatal exception in interrupt\n    ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\n\nThis is a minimal userspace reproducer on a Raspberry Pi Zero W:\n\n    #include \u003cstdio.h\u003e\n    #include \u003cmath.h\u003e\n\n    int main(void)\n    {\n            double v = 1.0;\n            printf(\"%fn\", NAN + *(volatile double *)\u0026v);\n            return 0;\n    }\n\nAnother way to consistently trigger the oops is:\n\n    calvin@raspberry-pi-zero-w ~$ python -c \"import json\"\n\nThe bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n,\nbecause the pr_debug() calls act as barriers even when not activated.\n\nThis is the output from the same kernel source built with the same\ncompiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as\nexpected:\n\n    VFP: bounce: trigger ec532b17 fpexc c0000780\n    VFP: emulate: INST=0xee377b06 SCR=0x00000000\n    VFP: bounce: trigger eef1fa10 fpexc c0000780\n    VFP: emulate: INST=0xeeb40b40 SCR=0x00000000\n    VFP: raising exceptions 30000000\n\n    calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer\n    nan\n\nCrudely grepping for vmsr/vmrs instructions in the otherwise nearly\nidential text for vfp_support_entry() makes the problem obvious:\n\n    vmlinux.llvm.good [0xc0101cb8] \u003c+48\u003e:  vmrs   r7, fpexc\n    vmlinux.llvm.good [0xc0101cd8] \u003c+80\u003e:  vmsr   fpexc, r0\n    vmlinux.llvm.good [0xc0101d20\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:39:24.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9fc60f2bdd43e758bdf0305c0fc83221419ddb3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b"
        },
        {
          "url": "https://git.kernel.org/stable/c/39caf610a63786b3b0ef3348ac015edc19827d6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a906dfa8c3b21b3e5360f73c49234ac1eb885b"
        }
      ],
      "title": "ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47716",
    "datePublished": "2024-10-21T11:53:47.434Z",
    "dateReserved": "2024-09-30T16:00:12.949Z",
    "dateUpdated": "2026-05-11T20:39:24.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47716",
      "date": "2026-09-17",
      "epss": "0.00219",
      "percentile": "0.12532"
    },
    "microsoft_vex": {
      "current_release_date": "2024-11-09T00:00:00.000Z",
      "cve": "CVE-2024-47716",
      "id": "msrc_CVE-2024-47716",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47716.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47716\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:07.943\",\"lastModified\":\"2026-06-17T07:57:36.937\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros\\n\\nFloating point instructions in userspace can crash some arm kernels\\nbuilt with clang/LLD 17.0.6:\\n\\n    BUG: unsupported FP instruction in kernel mode\\n    FPEXC == 0xc0000780\\n    Internal error: Oops - undefined instruction: 0 [#1] ARM\\n    CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1\\n    Hardware name: BCM2835\\n    PC is at vfp_support_entry+0xc8/0x2cc\\n    LR is at do_undefinstr+0xa8/0x250\\n    pc : [\u003cc0101d50\u003e]    lr : [\u003cc010a80c\u003e]    psr: a0000013\\n    sp : dc8d1f68  ip : 60000013  fp : bedea19c\\n    r10: ec532b17  r9 : 00000010  r8 : 0044766c\\n    r7 : c0000780  r6 : ec532b17  r5 : c1c13800  r4 : dc8d1fb0\\n    r3 : c10072c4  r2 : c0101c88  r1 : ec532b17  r0 : 0044766c\\n    Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\\n    Control: 00c5387d  Table: 0251c008  DAC: 00000051\\n    Register r0 information: non-paged memory\\n    Register r1 information: vmalloc memory\\n    Register r2 information: non-slab/vmalloc memory\\n    Register r3 information: non-slab/vmalloc memory\\n    Register r4 information: 2-page vmalloc region\\n    Register r5 information: slab kmalloc-cg-2k\\n    Register r6 information: vmalloc memory\\n    Register r7 information: non-slab/vmalloc memory\\n    Register r8 information: non-paged memory\\n    Register r9 information: zero-size pointer\\n    Register r10 information: vmalloc memory\\n    Register r11 information: non-paged memory\\n    Register r12 information: non-paged memory\\n    Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)\\n    Stack: (0xdc8d1f68 to 0xdc8d2000)\\n    1f60:                   0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0\\n    1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010\\n    1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188\\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000\\n    Call trace:\\n    [\u003cc0101d50\u003e] (vfp_support_entry) from [\u003cc010a80c\u003e] (do_undefinstr+0xa8/0x250)\\n    [\u003cc010a80c\u003e] (do_undefinstr) from [\u003cc0100f10\u003e] (__und_usr+0x70/0x80)\\n    Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)\\n    1fa0:                                     b6f68af8 00448fc0 00000000 bedea188\\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff\\n    Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)\\n    ---[ end trace 0000000000000000 ]---\\n    Kernel panic - not syncing: Fatal exception in interrupt\\n    ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\\n\\nThis is a minimal userspace reproducer on a Raspberry Pi Zero W:\\n\\n    #include \u003cstdio.h\u003e\\n    #include \u003cmath.h\u003e\\n\\n    int main(void)\\n    {\\n            double v = 1.0;\\n            printf(\\\"%fn\\\", NAN + *(volatile double *)\u0026v);\\n            return 0;\\n    }\\n\\nAnother way to consistently trigger the oops is:\\n\\n    calvin@raspberry-pi-zero-w ~$ python -c \\\"import json\\\"\\n\\nThe bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n,\\nbecause the pr_debug() calls act as barriers even when not activated.\\n\\nThis is the output from the same kernel source built with the same\\ncompiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as\\nexpected:\\n\\n    VFP: bounce: trigger ec532b17 fpexc c0000780\\n    VFP: emulate: INST=0xee377b06 SCR=0x00000000\\n    VFP: bounce: trigger eef1fa10 fpexc c0000780\\n    VFP: emulate: INST=0xeeb40b40 SCR=0x00000000\\n    VFP: raising exceptions 30000000\\n\\n    calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer\\n    nan\\n\\nCrudely grepping for vmsr/vmrs instructions in the otherwise nearly\\nidential text for vfp_support_entry() makes the problem obvious:\\n\\n    vmlinux.llvm.good [0xc0101cb8] \u003c+48\u003e:  vmrs   r7, fpexc\\n    vmlinux.llvm.good [0xc0101cd8] \u003c+80\u003e:  vmsr   fpexc, r0\\n    vmlinux.llvm.good [0xc0101d20\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ARM: 9410/1: vfp: usar asm vol\u00e1til en macros fmrx/fmxr Las instrucciones de punto flotante en el espacio de usuario pueden bloquear algunos kernels de ARM creados con clang/LLD 17.0.6: ERROR: instrucci\u00f3n FP no compatible en modo kernel FPEXC == 0xc0000780 Error interno: Ups - instrucci\u00f3n no definida: 0 [#1] CPU ARM: 0 PID: 196 Comm: vfp-reproducer No contaminado 6.10.0 #1 Nombre del hardware: BCM2835 La PC est\u00e1 en vfp_support_entry+0xc8/0x2cc LR est\u00e1 en do_undefinstr+0xa8/0x250 pc : [] lr : [] psr: a0000013 sp : dc8d1f68 ip : 60000013 fp : bedea19c r10: ec532b17 r9 : 00000010 r8 : 0044766c r7 : c0000780 r6 : ec532b17 r5 : c1c13800 r4 : dc8d1fb0 r3 : c10072c4 r2 : c0101c88 r1 : ec532b17 r0 : 0044766c Indicadores: NzCv IRQ en FIQ en modo SVC_32 ISA ARM Segmento ninguno Control: 00c5387d Tabla: 0251c008 DAC: 00000051 Informaci\u00f3n del registro r0: Informaci\u00f3n del registro r1: memoria vmalloc Informaci\u00f3n del registro r2: memoria no slab/vmalloc Informaci\u00f3n del registro r3: memoria no slab/vmalloc Informaci\u00f3n del registro r4: regi\u00f3n vmalloc de 2 p\u00e1ginas Informaci\u00f3n del registro r5: slab kmalloc-cg-2k Informaci\u00f3n del registro r6: memoria vmalloc Informaci\u00f3n del registro r7: memoria no slab/vmalloc Informaci\u00f3n del registro r8: memoria no paginada Informaci\u00f3n del registro r9: puntero de tama\u00f1o cero Informaci\u00f3n del registro r10: memoria vmalloc Informaci\u00f3n del registro r11: memoria no paginada Informaci\u00f3n del registro r12: memoria no paginada Proceso vfp-reproducer (pid: 196, l\u00edmite de pila = 0x61aaaf8b) Pila: (0xdc8d1f68 a 0xdc8d2000) 1f60: 0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0 1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010 1fa0: ffffffff c1c13800 7d c0100f10 b6f68af8 00448fc0 00000000 bedea188 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000 Seguimiento de llamadas: [] (vfp_support_entry) desde [] (do_undefinstr+0xa8/0x250) [] (do_undefinstr) desde [] (__und_usr+0x70/0x80) Pila de excepciones (0xdc8d1fb0 a 0xdc8d1ff8) 1fa0: b6f68af8 00448fc0 00000000 bedea188 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff C\u00f3digo: 0a000061 e3877202 e594003c e3a09010 (eef16a10) ---[ fin del seguimiento 000000000000000 ]--- P\u00e1nico del kernel: no sincroniza: Excepci\u00f3n fatal en la interrupci\u00f3n ---[ fin del kernel: no sincroniza: Excepci\u00f3n fatal en la interrupci\u00f3n ]--- Este es un reproductor de espacio de usuario m\u00ednimo en una Raspberry Pi Zero W: #include  #include  int main(void) { double v = 1.0; printf(\\\"%fn\\\", NAN + *(volatile double *)\u0026amp;v); return 0; } Otra forma de activar consistentemente el error es: calvin@raspberry-pi-zero-w ~$ python -c \\\"import json\\\" El error se reproduce solo cuando el kernel se construye con DYNAMIC_DEBUG=n, porque las llamadas pr_debug() act\u00faan como barreras incluso cuando no est\u00e1n activadas. Esta es la salida de la misma fuente del kernel creada con el mismo compilador y DYNAMIC_DEBUG=y, donde el reproductor de espacio de usuario funciona como se espera: VFP: bounce: trigger ec532b17 fpexc c0000780 VFP: emulate: INST=0xee377b06 SCR=0x00000000 VFP: bounce: trigger eef1fa10 fpexc c0000780 VFP: emulate: INST=0xeeb40b40 SCR=0x00000000 VFP: raising exceptions 30000000 calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer nan Buscar burdamente instrucciones vmsr/vmrs en el texto casi id\u00e9ntico de vfp_support_entry() hace que el problema sea obvio: vmlinux.llvm.good [0xc0101cb8] \u0026lt;+48\u0026gt;: vmrs r7, fpexc vmlinux.llvm.good [0xc0101cd8] \u0026lt;+80\u0026gt;: vmsr fpexc, r0 vmlinux.llvm.good [0xc0101d20 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm/vfp/vfpinstr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4708fb041346fa9cc6745dafb8c248a3e2f1075b\",\"lessThan\":\"9fc60f2bdd43e758bdf0305c0fc83221419ddb3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4708fb041346fa9cc6745dafb8c248a3e2f1075b\",\"lessThan\":\"cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4708fb041346fa9cc6745dafb8c248a3e2f1075b\",\"lessThan\":\"39caf610a63786b3b0ef3348ac015edc19827d6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4708fb041346fa9cc6745dafb8c248a3e2f1075b\",\"lessThan\":\"89a906dfa8c3b21b3e5360f73c49234ac1eb885b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm/vfp/vfpinstr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:02:37.747830Z\",\"id\":\"CVE-2024-47716\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"E729C51E-0317-4ABD-B95D-E6F8D80A17F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39caf610a63786b3b0ef3348ac015edc19827d6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89a906dfa8c3b21b3e5360f73c49234ac1eb885b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fc60f2bdd43e758bdf0305c0fc83221419ddb3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:01:27+00:00",
      "cve": "CVE-2024-47716",
      "id": "CVE-2024-47716",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47716.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47716\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:02:37.747830Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:02:40.761Z\"}}], \"cna\": {\"title\": \"ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4708fb041346fa9cc6745dafb8c248a3e2f1075b\", \"lessThan\": \"9fc60f2bdd43e758bdf0305c0fc83221419ddb3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4708fb041346fa9cc6745dafb8c248a3e2f1075b\", \"lessThan\": \"cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4708fb041346fa9cc6745dafb8c248a3e2f1075b\", \"lessThan\": \"39caf610a63786b3b0ef3348ac015edc19827d6a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4708fb041346fa9cc6745dafb8c248a3e2f1075b\", \"lessThan\": \"89a906dfa8c3b21b3e5360f73c49234ac1eb885b\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm/vfp/vfpinstr.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm/vfp/vfpinstr.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9fc60f2bdd43e758bdf0305c0fc83221419ddb3f\"}, {\"url\": \"https://git.kernel.org/stable/c/cd595d87e5fdd2fc09ea69359aa85e7f12f4b97b\"}, {\"url\": \"https://git.kernel.org/stable/c/39caf610a63786b3b0ef3348ac015edc19827d6a\"}, {\"url\": \"https://git.kernel.org/stable/c/89a906dfa8c3b21b3e5360f73c49234ac1eb885b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros\\n\\nFloating point instructions in userspace can crash some arm kernels\\nbuilt with clang/LLD 17.0.6:\\n\\n    BUG: unsupported FP instruction in kernel mode\\n    FPEXC == 0xc0000780\\n    Internal error: Oops - undefined instruction: 0 [#1] ARM\\n    CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1\\n    Hardware name: BCM2835\\n    PC is at vfp_support_entry+0xc8/0x2cc\\n    LR is at do_undefinstr+0xa8/0x250\\n    pc : [\u003cc0101d50\u003e]    lr : [\u003cc010a80c\u003e]    psr: a0000013\\n    sp : dc8d1f68  ip : 60000013  fp : bedea19c\\n    r10: ec532b17  r9 : 00000010  r8 : 0044766c\\n    r7 : c0000780  r6 : ec532b17  r5 : c1c13800  r4 : dc8d1fb0\\n    r3 : c10072c4  r2 : c0101c88  r1 : ec532b17  r0 : 0044766c\\n    Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\\n    Control: 00c5387d  Table: 0251c008  DAC: 00000051\\n    Register r0 information: non-paged memory\\n    Register r1 information: vmalloc memory\\n    Register r2 information: non-slab/vmalloc memory\\n    Register r3 information: non-slab/vmalloc memory\\n    Register r4 information: 2-page vmalloc region\\n    Register r5 information: slab kmalloc-cg-2k\\n    Register r6 information: vmalloc memory\\n    Register r7 information: non-slab/vmalloc memory\\n    Register r8 information: non-paged memory\\n    Register r9 information: zero-size pointer\\n    Register r10 information: vmalloc memory\\n    Register r11 information: non-paged memory\\n    Register r12 information: non-paged memory\\n    Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)\\n    Stack: (0xdc8d1f68 to 0xdc8d2000)\\n    1f60:                   0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0\\n    1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010\\n    1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188\\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000\\n    Call trace:\\n    [\u003cc0101d50\u003e] (vfp_support_entry) from [\u003cc010a80c\u003e] (do_undefinstr+0xa8/0x250)\\n    [\u003cc010a80c\u003e] (do_undefinstr) from [\u003cc0100f10\u003e] (__und_usr+0x70/0x80)\\n    Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)\\n    1fa0:                                     b6f68af8 00448fc0 00000000 bedea188\\n    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\\n    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff\\n    Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)\\n    ---[ end trace 0000000000000000 ]---\\n    Kernel panic - not syncing: Fatal exception in interrupt\\n    ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\\n\\nThis is a minimal userspace reproducer on a Raspberry Pi Zero W:\\n\\n    #include \u003cstdio.h\u003e\\n    #include \u003cmath.h\u003e\\n\\n    int main(void)\\n    {\\n            double v = 1.0;\\n            printf(\\\"%fn\\\", NAN + *(volatile double *)\u0026v);\\n            return 0;\\n    }\\n\\nAnother way to consistently trigger the oops is:\\n\\n    calvin@raspberry-pi-zero-w ~$ python -c \\\"import json\\\"\\n\\nThe bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n,\\nbecause the pr_debug() calls act as barriers even when not activated.\\n\\nThis is the output from the same kernel source built with the same\\ncompiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as\\nexpected:\\n\\n    VFP: bounce: trigger ec532b17 fpexc c0000780\\n    VFP: emulate: INST=0xee377b06 SCR=0x00000000\\n    VFP: bounce: trigger eef1fa10 fpexc c0000780\\n    VFP: emulate: INST=0xeeb40b40 SCR=0x00000000\\n    VFP: raising exceptions 30000000\\n\\n    calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer\\n    nan\\n\\nCrudely grepping for vmsr/vmrs instructions in the otherwise nearly\\nidential text for vfp_support_entry() makes the problem obvious:\\n\\n    vmlinux.llvm.good [0xc0101cb8] \u003c+48\u003e:  vmrs   r7, fpexc\\n    vmlinux.llvm.good [0xc0101cd8] \u003c+80\u003e:  vmsr   fpexc, r0\\n    vmlinux.llvm.good [0xc0101d20\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:38:10.072Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47716\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:38:10.072Z\", \"dateReserved\": \"2024-09-30T16:00:12.949Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:47.434Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.