CVE-2024-58000
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/02/2025
Last modified:
23/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
io_uring: prevent reg-wait speculations<br />
<br />
With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments<br />
for the waiting loop the user can specify an offset into a pre-mapped<br />
region of memory, in which case the<br />
[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the<br />
argument.<br />
<br />
As we address a kernel array using a user given index, it&#39;d be a subject<br />
to speculation type of exploits. Use array_index_nospec() to prevent<br />
that. Make sure to pass not the full region size but truncate by the<br />
maximum offset allowed considering the structure size.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page