Bug#1104015: llvm-toolchain-19: CVE-2024-7883

[Salvatore Bonaccorso]

Source: llvm-toolchain-19
Version: 1:19.1.7-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: clone -1 -2 -3 -4
Control: reassign -2 src:llvm-toolchain-18 1:18.1.8-17
Control: retitle -2 llvm-toolchain-18: CVE-2024-7883
Control: reassing -3 src:llvm-toolchain-17 1:17.0.6-21
Control: retitle -3 llvm-toolchain-17: CVE-2024-7883
Control: reassign -4 src:llvm-toolchain-14 1:14.0.6-20
Control: retitle -4 llvm-toolchain-14: CVE-2024-7883

Hi,

The following vulnerability was published for llvm-toolchain-*.

CVE-2024-7883[0]:
| When using Arm Cortex-M Security Extensions (CMSE), Secure stack
| contents can be leaked to Non-secure state via floating-point
| registers  when a Secure to Non-secure function call is made that
| returns a  floating-point value and when this is the first use of
| floating-point  since entering Secure state. This allows an attacker
| to read a limited  quantity of Secure stack contents with an impact
| on confidentiality.  This issue is specific to code generated using
| LLVM-based compilers.

This is more for tracking ad I do not expect we can have it fixed in
the respective other branches than 20.x.

In case it i still fixed:

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-7883
    https://www.cve.org/CVERecord?id=CVE-2024-7883
[1] https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability
[2] https://bugzilla.redhat.com/show_bug.cgi?id=2322994
[3] https://github.com/llvm/llvm-project/pull/114433

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore