{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58006", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:10:48.227Z", "datePublished": "2025-02-27T02:12:02.932Z", "dateUpdated": "2026-08-05T11:47:23.409Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:23.409Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\"PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\") set_bar() was modified to support dynamically\nchanging the backing physical address of a BAR that was already configured.\n\nThis means that set_bar() can be called twice, without ever calling\nclear_bar() (as calling clear_bar() would clear the BAR's PCI address\nassigned by the host).\n\nThis can only be done if the new BAR size/flags does not differ from the\nexisting BAR configuration. Add these missing checks.\n\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\nexisting BAR size, the new address translation range will be smaller than\nthe BAR size already determined by the host, which would mean that a read\npast the new BAR size would pass the iATU untranslated, which could allow\nthe host to read memory not belonging to the new struct pci_epf_bar.\n\nWhile at it, add comments which clarifies the support for dynamically\nchanging the physical address of a BAR. (Which was also missing.)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:A - The attacker is the PCIe root complex on the other end of an existing point-to-point link (the classic Linux EP deployment: DPU/SmartNIC/accelerator or NTB host-to-host interconnect), sending TLPs and scratchpad writes over a shared, non-routable fabric — a logically adjacent topology. No physical manipulation of the endpoint is needed at exploit time, so this is Adjacent rather than Physical or Local.\nAC:L - The peer host fully and deterministically controls the memory-window size it advertises in the NTB scratchpads, which propagates unvalidated to `epf_bar->size` and reprograms the inbound iATU; there is no race, timing window, or memory-layout condition outside the attacker's control.\nPR:N - NTB link negotiation performs no authentication whatsoever — the endpoint reads the size scratchpads from the host-writable control BAR as soon as the link comes up, so the attacking host needs no credentials or privileges on the endpoint system.\nUI:N - The endpoint's `ntb_transport_link_work()` runs automatically on link-up and consumes the host-supplied sizes with no operator action; the attacker drives the entire sequence from its own side of the link.\nS:C - The inbound iATU is the endpoint's address-translation and containment boundary for host-originated transactions — the endpoint-side equivalent of an IOMMU — and this bug lets transactions pass it untranslated. A failure of that DMA/address-translation boundary lets one security authority (the remote host) reach memory in a different authority (the endpoint OS), matching the IOMMU/DMA-bypass Changed criterion.\nC:H - With the BAR aperture larger than the translation window, the host can read endpoint physical memory outside the backing `pci_epf_bar` allocation — the commit message states this explicitly — yielding a large out-of-bounds/effectively arbitrary kernel memory read.\nI:H - PCI memory BAR windows are read/write, so the same mis-sized window gives the host out-of-bounds writes into endpoint physical memory beyond the intended buffer, corrupting adjacent kernel data or code and enabling control-flow hijacking on the endpoint.\nA:H - Arbitrary writes into endpoint physical memory readily panic the kernel, and untranslated transactions escaping the iATU onto the internal bus can raise bus errors/aborts, crashing or hanging the endpoint system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pci/controller/dwc/pcie-designware-ep.c" ], "versions": [ { "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c", "lessThan": "b5cacfd067060c75088363ed3e19779078be2755", "status": "affected", "versionType": "git" }, { "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c", "lessThan": "3229c15d6267de8e704b4085df8a82a5af2d63eb", "status": "affected", "versionType": "git" }, { "version": "4284c88fff0efc4e418abb53d78e02dc4f099d6c", "lessThan": "3708acbd5f169ebafe1faa519cb28adc56295546", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pci/controller/dwc/pcie-designware-ep.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b5cacfd067060c75088363ed3e19779078be2755" }, { "url": "https://git.kernel.org/stable/c/3229c15d6267de8e704b4085df8a82a5af2d63eb" }, { "url": "https://git.kernel.org/stable/c/3708acbd5f169ebafe1faa519cb28adc56295546" } ], "title": "PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()", "x_generator": { "engine": "bippy-1.2.0" } } } }