Linux kernel (drivers/pci/controller/dwc): A PCIe BAR window can end up larger than the memory actually backing it, so

CVSS 9.6CVE-2024-58006Kernel, userspace & hypervisorcurated

Impact

A PCIe BAR window can end up larger than the memory actually backing it, so accesses past the real allocation sail through the inbound address translation unit untranslated. The device on the other end of the link gets to read and write host memory that was never meant to be exposed through that BAR - a straight boundary break across the PCIe link, which is why the kernel CNA scored it 9.6 with a changed scope.

Who can reach it

Only applies to a machine running Linux in PCIe ENDPOINT mode on a DesignWare controller - i.e. the box is the device, not the host. The peer that exploits it is the PCIe host on the other side of the link, pre-authentication, by re-driving BAR setup so a second pci_epc_set_bar() shrinks the window without a matching clear_bar(). This is not the usual configuration for a GPU-cluster compute node; audit it if you run DWC-based endpoint cards, smartNICs or DPUs that terminate a host link, and treat the connected host as the attacker.

What to do

Update to a kernel carrying the fix (no fixed_in published by the CNA - track the stable commits below into your 6.1.y / 6.6.y / 6.12.y branch). Interim: do not allow an endpoint function driver to re-invoke set_bar() on an already-configured BAR, and unbind endpoint function drivers on any DWC endpoint you are not actively using.

References

https://git.kernel.org/stable/c/b5cacfd067060c75088363ed3e19779078be2755 https://git.kernel.org/stable/c/3229c15d6267de8e704b4085df8a82a5af2d63eb https://nvd.nist.gov/vuln/detail/CVE-2024-58006

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.