Critical Vulnerability in Linux Package: PCI BAR Size/Flags Modification Risk
Summary
DEBIAN-CVE-2024-58006: In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound m... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient communication between software and hardware. This vulnerability specifically affects the PCI subsystem, which is responsible for managing peripheral devices, highlighting the importance of maintaining robust security measures within the kernel.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the PCI subsystem, specifically in the pci_epc_set_bar() function. This function was modified to allow dynamic changes to the backing physical address of a Base Address Register (BAR) without the need to call clear_bar(). This modification can lead to potential security risks, as it allows for the possibility of changing the BAR size or flags without proper checks. If an attacker can manipulate the BAR size, it may result in unauthorized access to memory regions, leading to data corruption or leakage. The vulnerability was introduced in commit 4284c88fff0e, which failed to implement necessary checks for size and flags consistency during the BAR configuration process.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux package poses significant risks related to the PCI subsystem's management of BAR configurations. It is essential for users to update their systems to the patched version to ensure security and prevent potential exploitation. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows for the modification of the BAR size and flags without proper checks, potentially leading to unauthorized memory access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability may result in unauthorized access to sensitive memory regions, leading to data corruption or leakage.
Yes, the vulnerability affects the Linux package in Debian versions 13 and 14, specifically before version 6.12.15-1.
While there are no specific workarounds, it is crucial to prioritize updating your package to the patched version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
