CVE-2024-58006

A flaw was found in the Linux kernel's Peripheral Component Interconnect Express (PCIe) DesignWare endpoint driver. When dynamically reconfiguring a Base Address Register (BAR), the driver fails to verify that the new BAR size and flags match the existing configuration. If a smaller size is configured, memory read requests from the connected host device can bypass address translation, allowing the host to read unauthorized system memory.

Red Hat has evaluated this vulnerability as having a Moderate severity because it specifically impacts systems configured to run as PCIe endpoints using Synopsys DesignWare controllers, rather than standard host systems. Exploitation requires the kernel to operate in PCIe endpoint mode with dynamic Base Address Register reconfiguration enabled, which is not used in typical enterprise installations. Consequently, standard server and cloud deployments are unaffected, and exposure is primarily restricted to specialized embedded or automotive environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.