{"id":"CVE-2024-58006","title":"PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\"PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\") se…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 01aaa7935af3050fd1e1e7de50001247c75baeab","Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < b5cacfd067060c75088363ed3e19779078be2755","Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 3229c15d6267de8e704b4085df8a82a5af2d63eb","Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 3708acbd5f169ebafe1faa519cb28adc56295546","Linux 6.0"],"published":"2025-02-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:35:49.165Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-58006","references":[{"url":"https://git.kernel.org/stable/c/01aaa7935af3050fd1e1e7de50001247c75baeab"},{"url":"https://git.kernel.org/stable/c/b5cacfd067060c75088363ed3e19779078be2755"},{"url":"https://git.kernel.org/stable/c/3229c15d6267de8e704b4085df8a82a5af2d63eb"},{"url":"https://git.kernel.org/stable/c/3708acbd5f169ebafe1faa519cb28adc56295546"}],"tags":["cve.org"],"epss":0.00291,"epssPercentile":0.21562,"ingestedAt":"2026-10-21T12:48:53.721Z","slug":"CVE-2024-58006","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\"PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\") set_bar() was modified to support dynamically\nchanging the backing physical address of a BAR that was already configured.\n\nThis means that set_bar() can be called twice, without ever calling\nclear_bar() (as calling clear_bar() would clear the BAR's PCI address\nassigned by the host).\n\nThis can only be done if the new BAR size/flags does not differ from the\nexisting BAR configuration. Add these missing checks.\n\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\nexisting BAR size, the new address translation range will be smaller than\nthe BAR size already determined by the host, which would mean that a read\npast the new BAR size would pass the iATU untranslated, which could allow\nthe host to read memory not belonging to the new struct pci_epf_bar.\n\nWhile at it, add comments which clarifies the support for dynamically\nchanging the physical address of a BAR. (Which was also missing.)\n\n## Affected\n\n- `Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 01aaa7935af3050fd1e1e7de50001247c75baeab`\n- `Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < b5cacfd067060c75088363ed3e19779078be2755`\n- `Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 3229c15d6267de8e704b4085df8a82a5af2d63eb`\n- `Linux >= 4284c88fff0efc4e418abb53d78e02dc4f099d6c < 3708acbd5f169ebafe1faa519cb28adc56295546`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}