CVE-2024-58006 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
A missing check in the Linux kernel PCI DWC endpoint driver allows a host to read memory outside the intended BAR range, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58006?
CVE-2024-58006 is a critical vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured.
This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host).
This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks.
If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar.
While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.)
Which versions are affected by CVE-2024-58006?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58006?
Apply the vendor's patch.
Is CVE-2024-58006 being exploited?
There is no known exploitation of CVE-2024-58006 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62767, BELL-CVE-2024-58006, DEBIAN-CVE-2024-58006, GHSA-wf3x-qxfc-v57v, ROOT-OS-DEBIAN-12-CVE-2024-58006, ROOT-OS-UBUNTU-2404-CVE-2024-58006 and 1 more.