CVE-2024-58000

MEDIUM EPSS 6.9%
Published Feb 27, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Feb 27, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent reg-wait speculations With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments for the waiting loop the user can specify an offset into a pre-mapped region of memory, in which case the [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the argument. As we address a kernel array using a user given index, it'd be a subject to speculation type of exploits. Use array_index_nospec() to prevent that. Make sure to pass not the full region size but truncate by the maximum offset allowed considering the structure size.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
6.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 1

VendorProductVersionRange
linuxlinux_kernel*≥6.13  –  <6.13.2

References 2

  • git.kernel.org https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a
    Patch