CVE-2024-58006 (GCVE-0-2024-58006)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:47
VLAI
Title
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured. This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.)
Severity
9.6 (Critical)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4284c88fff0efc4e418abb53d78e02dc4f099d6c , < b5cacfd067060c75088363ed3e19779078be2755 (git)
Affected: 4284c88fff0efc4e418abb53d78e02dc4f099d6c , < 3229c15d6267de8e704b4085df8a82a5af2d63eb (git)
Affected: 4284c88fff0efc4e418abb53d78e02dc4f099d6c , < 3708acbd5f169ebafe1faa519cb28adc56295546 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.12.14 , ≤ 6.12.* (semver)
Unaffected: 6.13.3 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5cacfd067060c75088363ed3e19779078be2755",
              "status": "affected",
              "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c",
              "versionType": "git"
            },
            {
              "lessThan": "3229c15d6267de8e704b4085df8a82a5af2d63eb",
              "status": "affected",
              "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c",
              "versionType": "git"
            },
            {
              "lessThan": "3708acbd5f169ebafe1faa519cb28adc56295546",
              "status": "affected",
              "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\"PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\") set_bar() was modified to support dynamically\nchanging the backing physical address of a BAR that was already configured.\n\nThis means that set_bar() can be called twice, without ever calling\nclear_bar() (as calling clear_bar() would clear the BAR\u0027s PCI address\nassigned by the host).\n\nThis can only be done if the new BAR size/flags does not differ from the\nexisting BAR configuration. Add these missing checks.\n\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\nexisting BAR size, the new address translation range will be smaller than\nthe BAR size already determined by the host, which would mean that a read\npast the new BAR size would pass the iATU untranslated, which could allow\nthe host to read memory not belonging to the new struct pci_epf_bar.\n\nWhile at it, add comments which clarifies the support for dynamically\nchanging the physical address of a BAR. (Which was also missing.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The attacker is the PCIe root complex on the other end of an existing point-to-point link (the classic Linux EP deployment: DPU/SmartNIC/accelerator or NTB host-to-host interconnect), sending TLPs and scratchpad writes over a shared, non-routable fabric \u2014 a logically adjacent topology. No physical manipulation of the endpoint is needed at exploit time, so this is Adjacent rather than Physical or Local.\nAC:L - The peer host fully and deterministically controls the memory-window size it advertises in the NTB scratchpads, which propagates unvalidated to `epf_bar-\u003esize` and reprograms the inbound iATU; there is no race, timing window, or memory-layout condition outside the attacker\u0027s control.\nPR:N - NTB link negotiation performs no authentication whatsoever \u2014 the endpoint reads the size scratchpads from the host-writable control BAR as soon as the link comes up, so the attacking host needs no credentials or privileges on the endpoint system.\nUI:N - The endpoint\u0027s `ntb_transport_link_work()` runs automatically on link-up and consumes the host-supplied sizes with no operator action; the attacker drives the entire sequence from its own side of the link.\nS:C - The inbound iATU is the endpoint\u0027s address-translation and containment boundary for host-originated transactions \u2014 the endpoint-side equivalent of an IOMMU \u2014 and this bug lets transactions pass it untranslated. A failure of that DMA/address-translation boundary lets one security authority (the remote host) reach memory in a different authority (the endpoint OS), matching the IOMMU/DMA-bypass Changed criterion.\nC:H - With the BAR aperture larger than the translation window, the host can read endpoint physical memory outside the backing `pci_epf_bar` allocation \u2014 the commit message states this explicitly \u2014 yielding a large out-of-bounds/effectively arbitrary kernel memory read.\nI:H - PCI memory BAR windows are read/write, so the same mis-sized window gives the host out-of-bounds writes into endpoint physical memory beyond the intended buffer, corrupting adjacent kernel data or code and enabling control-flow hijacking on the endpoint.\nA:H - Arbitrary writes into endpoint physical memory readily panic the kernel, and untranslated transactions escaping the iATU onto the internal bus can raise bus errors/aborts, crashing or hanging the endpoint system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:23.409Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5cacfd067060c75088363ed3e19779078be2755"
        },
        {
          "url": "https://git.kernel.org/stable/c/3229c15d6267de8e704b4085df8a82a5af2d63eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3708acbd5f169ebafe1faa519cb28adc56295546"
        }
      ],
      "title": "PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58006",
    "datePublished": "2025-02-27T02:12:02.932Z",
    "dateReserved": "2025-02-27T02:10:48.227Z",
    "dateUpdated": "2026-08-05T11:47:23.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58006",
      "date": "2026-08-06",
      "epss": "0.00232",
      "percentile": "0.14059"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:57:09.000Z",
      "cve": "CVE-2024-58006",
      "id": "msrc_CVE-2024-58006",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_affected": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-58006.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58006\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:11.583\",\"lastModified\":\"2026-08-04T11:22:36.473\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\\n\\nIn commit 4284c88fff0e (\\\"PCI: designware-ep: Allow pci_epc_set_bar() update\\ninbound map address\\\") set_bar() was modified to support dynamically\\nchanging the backing physical address of a BAR that was already configured.\\n\\nThis means that set_bar() can be called twice, without ever calling\\nclear_bar() (as calling clear_bar() would clear the BAR\u0027s PCI address\\nassigned by the host).\\n\\nThis can only be done if the new BAR size/flags does not differ from the\\nexisting BAR configuration. Add these missing checks.\\n\\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\\nexisting BAR size, the new address translation range will be smaller than\\nthe BAR size already determined by the host, which would mean that a read\\npast the new BAR size would pass the iATU untranslated, which could allow\\nthe host to read memory not belonging to the new struct pci_epf_bar.\\n\\nWhile at it, add comments which clarifies the support for dynamically\\nchanging the physical address of a BAR. (Which was also missing.)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: dwc: ep: Impedir cambiar el tama\u00f1o/indicadores de BAR en pci_epc_set_bar() En el commit 4284c88fff0e (\\\"PCI: designware-ep: Permitir que pci_epc_set_bar() actualice la direcci\u00f3n del mapa de entrada\\\"), se modific\u00f3 set_bar() para admitir el cambio din\u00e1mico de la direcci\u00f3n f\u00edsica de respaldo de un BAR que ya estaba configurado. Esto significa que se puede llamar a set_bar() dos veces, sin llamar nunca a clear_bar() (ya que llamar a clear_bar() borrar\u00eda la direcci\u00f3n PCI del BAR asignada por el host). Esto solo se puede hacer si el nuevo tama\u00f1o/indicadores de BAR no difieren de la configuraci\u00f3n de BAR existente. Agregue estas comprobaciones faltantes. Si permitimos que set_bar() establezca, por ejemplo, un nuevo tama\u00f1o de BAR que difiere del tama\u00f1o de BAR existente, el nuevo rango de traducci\u00f3n de direcciones ser\u00e1 m\u00e1s peque\u00f1o que el tama\u00f1o de BAR ya determinado por el host, lo que significar\u00eda que una lectura m\u00e1s all\u00e1 del nuevo tama\u00f1o de BAR pasar\u00eda la iATU sin traducir, lo que podr\u00eda permitir que el host lea memoria que no pertenece a la nueva estructura pci_epf_bar. Mientras tanto, agregue comentarios que aclaren el soporte para cambiar din\u00e1micamente la direcci\u00f3n f\u00edsica de un BAR. (Lo cual tambi\u00e9n faltaba).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pci/controller/dwc/pcie-designware-ep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4284c88fff0efc4e418abb53d78e02dc4f099d6c\",\"lessThan\":\"b5cacfd067060c75088363ed3e19779078be2755\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4284c88fff0efc4e418abb53d78e02dc4f099d6c\",\"lessThan\":\"3229c15d6267de8e704b4085df8a82a5af2d63eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4284c88fff0efc4e418abb53d78e02dc4f099d6c\",\"lessThan\":\"3708acbd5f169ebafe1faa519cb28adc56295546\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pci/controller/dwc/pcie-designware-ep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.14\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.3\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.12.14\",\"matchCriteriaId\":\"8FE883B1-A489-49BC-BB7A-E21F9054092B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.3\",\"matchCriteriaId\":\"0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3229c15d6267de8e704b4085df8a82a5af2d63eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3708acbd5f169ebafe1faa519cb28adc56295546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5cacfd067060c75088363ed3e19779078be2755\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:07:55+00:00",
      "cve": "CVE-2024-58006",
      "id": "CVE-2024-58006",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58006.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:48:08Z",
      "cve": "CVE-2024-58006",
      "id": "CVE-2024-58006",
      "initial_release_date": "2025-02-28T02:23:06Z",
      "product_status:known_affected": "451",
      "product_status:known_not_affected": "229",
      "product_status:recommended": "404",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-58006",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-58006.json",
      "version": "45"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.