CVE-2024-58006 addresses a vulnerability in the Linux kernel's PCI endpoint controller (dwc ep) driver, specifically in the function pci_epc_set_bar(). The vulnerability arises from the ability to change the Base Address Register (BAR) size or flags without proper validation. In a prior commit (4284c88fff0e), the pci_epc_set_bar() function was modified to allow dynamic updates to the backing physical address of an already configured BAR. However, this change permitted the function to be called multiple times without clearing the BAR first, which is problematic if the new BAR size or flags differ from the existing configuration. The missing checks allowed scenarios where the new BAR size could be smaller than the original size assigned by the host. This discrepancy could cause the inbound address translation unit (iATU) to pass reads beyond the new BAR size untranslated, potentially enabling the host to read memory regions outside the intended BAR structure. Such unauthorized memory reads could lead to information disclosure or other unintended behavior. The patch adds necessary validation to prevent changes to BAR size or flags once set, ensuring that only the backing physical address can be updated dynamically without clearing the BAR. Additionally, clarifying comments were added to document this behavior. This vulnerability affects Linux kernel versions containing the specified commit and is relevant to systems using the DesignWare PCI endpoint controller driver. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected DesignWare PCI endpoint controller driver, which is common in embedded systems, networking equipment, and specialized hardware platforms. Exploitation could allow a malicious host or attacker with PCI bus access to read unauthorized memory areas on the endpoint device, potentially leaking sensitive data or compromising device integrity. This is particularly concerning for critical infrastructure sectors such as telecommunications, industrial control systems, and data centers that rely on Linux-based embedded devices or network appliances. While exploitation requires privileged access to the PCI bus, which limits remote attack vectors, insider threats or supply chain compromises could leverage this flaw. The vulnerability could undermine confidentiality and integrity of data processed by affected devices, impacting operational security and compliance with data protection regulations such as GDPR. The absence of known exploits reduces immediate risk, but the potential for targeted attacks in high-value environments remains.

European organizations should prioritize updating Linux kernels to versions that include the patch for CVE-2024-58006. Specifically, ensure that the DesignWare PCI endpoint controller driver is updated to versions that enforce BAR size and flag immutability after initial configuration. For embedded and network devices, coordinate with hardware vendors to obtain firmware or kernel updates addressing this issue. Additionally, restrict physical and logical access to PCI buses to trusted personnel and systems to prevent unauthorized manipulation of PCI configuration space. Implement strict hardware inventory and monitoring to detect unauthorized devices or changes on the PCI bus. For high-security environments, consider deploying hardware-based PCIe access control mechanisms or IOMMU configurations to limit device memory access. Regularly audit kernel versions and driver configurations in critical systems to ensure compliance with security patches. Finally, maintain robust incident response plans to quickly address any detected exploitation attempts.