CVE-2024-58000 Details
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent reg-wait speculations With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments for the waiting loop the user can specify an offset into a pre-mapped region of memory, in which case the [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the argument. As we address a kernel array using a user given index, it'd be a subject to speculation type of exploits. Use array_index_nospec() to prevent that. Make sure to pass not the full region size but truncate by the maximum offset allowed considering the structure size.
A vulnerability in the Linux kernel's io_uring implementation allowed for speculation-based exploits by improperly handling user-specified offsets in memory. This issue arose because the kernel array was accessed using user-provided indices, creating a potential for speculative execution vulnerabilities. The vulnerability has been addressed by using array_index_nospec() to mitigate the risk and ensuring that the size of the memory region is correctly truncated based on the maximum allowable offset.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.13, < 6.13.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 23, 2025 | Initial Analysis | [email protected] |
| Feb 27, 2025 | New CVE Received | kernel.org |