CVE-2024-58000 (GCVE-0-2024-58000)
Vulnerability from cvelistv5
Published
2025-02-27 02:07
Modified
2025-05-04 10:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent reg-wait speculations With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments for the waiting loop the user can specify an offset into a pre-mapped region of memory, in which case the [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the argument. As we address a kernel array using a user given index, it'd be a subject to speculation type of exploits. Use array_index_nospec() to prevent that. Make sure to pass not the full region size but truncate by the maximum offset allowed considering the structure size.
References
Impacted products
Vendor Product Version
Linux Linux Version: aa00f67adc2c0d6439f81b5a81ff181377c47a7e
Version: aa00f67adc2c0d6439f81b5a81ff181377c47a7e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a6de94df7bfa76d9850443547e7b3333f63a16a",
              "status": "affected",
              "version": "aa00f67adc2c0d6439f81b5a81ff181377c47a7e",
              "versionType": "git"
            },
            {
              "lessThan": "29b95ac917927ce9f95bf38797e16333ecb489b1",
              "status": "affected",
              "version": "aa00f67adc2c0d6439f81b5a81ff181377c47a7e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: prevent reg-wait speculations\n\nWith *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments\nfor the waiting loop the user can specify an offset into a pre-mapped\nregion of memory, in which case the\n[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the\nargument.\n\nAs we address a kernel array using a user given index, it\u0027d be a subject\nto speculation type of exploits. Use array_index_nospec() to prevent\nthat. Make sure to pass not the full region size but truncate by the\nmaximum offset allowed considering the structure size."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T10:08:06.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a"
        },
        {
          "url": "https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1"
        }
      ],
      "title": "io_uring: prevent reg-wait speculations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58000",
    "datePublished": "2025-02-27T02:07:19.155Z",
    "dateReserved": "2025-02-27T02:04:28.915Z",
    "dateUpdated": "2025-05-04T10:08:06.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58000\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T02:15:14.033\",\"lastModified\":\"2025-02-27T02:15:14.033\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: prevent reg-wait speculations\\n\\nWith *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments\\nfor the waiting loop the user can specify an offset into a pre-mapped\\nregion of memory, in which case the\\n[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the\\nargument.\\n\\nAs we address a kernel array using a user given index, it\u0027d be a subject\\nto speculation type of exploits. Use array_index_nospec() to prevent\\nthat. Make sure to pass not the full region size but truncate by the\\nmaximum offset allowed considering the structure size.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring: evitar especulaciones de reg-wait Con *ENTER_EXT_ARG_REG en lugar de pasar un puntero de usuario con argumentos para el bucle de espera, el usuario puede especificar un desplazamiento en una regi\u00f3n de memoria preasignada, en cuyo caso [offset, offset + sizeof(io_uring_reg_wait)) se interpretar\u00e1 como el argumento. Como direccionamos una matriz del kernel usando un \u00edndice dado por el usuario, ser\u00eda un tema de tipo especulativo de exploits. Use array_index_nospec() para evitar eso. Aseg\u00farese de no pasar el tama\u00f1o completo de la regi\u00f3n, sino truncarlo por el desplazamiento m\u00e1ximo permitido considerando el tama\u00f1o de la estructura.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.