Critical Vulnerability in Linux Kernel: PCI BAR Size/Flags Modification Risk
Summary
CVE-2024-58006: In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound m... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used in various distributions, including Debian. The kernel's PCI subsystem is responsible for managing PCI devices, which are crucial for system performance and functionality. This vulnerability specifically affects the designware endpoint (dwc) PCI driver, which is responsible for handling PCI Express devices in embedded systems.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the pci_epc_set_bar() function, which allows for the dynamic modification of the Base Address Register (BAR) settings without proper checks. This flaw arises from a modification made in commit 4284c88fff0e, which permits the backing physical address of a BAR to be changed after it has been configured. If the new BAR size or flags differ from the existing configuration, it can lead to unauthorized memory access, as the new address translation range may be smaller than the previously determined BAR size. This could allow the host to read memory that does not belong to the new struct pci_epf_bar, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as described in the 'how_to_fix' section.
Conclusion
The vulnerability CVE-2024-58006 in the Linux kernel poses a significant risk due to improper handling of PCI BAR modifications. Users are strongly encouraged to update their systems to the latest kernel version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58006 is a vulnerability in the Linux kernel that allows for unsafe modification of PCI BAR settings, potentially leading to unauthorized memory access.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring code access.
The primary risk is that an attacker could exploit the vulnerability to read memory that should not be accessible, potentially leading to data breaches or system instability.
Yes, a patch is available in the updated versions of the Linux kernel. Users are advised to update their systems to the latest version to mitigate the risk.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to protect against this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
