CVE-2024-58006

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The attacker is the PCIe root complex on the other end of an existing point-to-point link (the classic Linux EP deployment: DPU/SmartNIC/accelerator or NTB host-to-host interconnect), sending TLPs and scratchpad writes over a shared, non-routable fabric — a logically adjacent topology. No physical manipulation of the endpoint is needed at exploit time, so this is Adjacent rather than Physical or Local.

AC:LAttack complexity, low

The peer host fully and deterministically controls the memory-window size it advertises in the NTB scratchpads, which propagates unvalidated to `epf_bar->size` and reprograms the inbound iATU; there is no race, timing window, or memory-layout condition outside the attacker's control.

PR:NPrivileges required, none

NTB link negotiation performs no authentication whatsoever — the endpoint reads the size scratchpads from the host-writable control BAR as soon as the link comes up, so the attacking host needs no credentials or privileges on the endpoint system.

UI:NUser interaction, none

The endpoint's `ntb_transport_link_work()` runs automatically on link-up and consumes the host-supplied sizes with no operator action; the attacker drives the entire sequence from its own side of the link.

S:CScope, changed

The inbound iATU is the endpoint's address-translation and containment boundary for host-originated transactions — the endpoint-side equivalent of an IOMMU — and this bug lets transactions pass it untranslated. A failure of that DMA/address-translation boundary lets one security authority (the remote host) reach memory in a different authority (the endpoint OS), matching the IOMMU/DMA-bypass Changed criterion.

C:HConfidentiality impact, high

With the BAR aperture larger than the translation window, the host can read endpoint physical memory outside the backing `pci_epf_bar` allocation — the commit message states this explicitly — yielding a large out-of-bounds/effectively arbitrary kernel memory read.

I:HIntegrity impact, high

PCI memory BAR windows are read/write, so the same mis-sized window gives the host out-of-bounds writes into endpoint physical memory beyond the intended buffer, corrupting adjacent kernel data or code and enabling control-flow hijacking on the endpoint.

A:HAvailability impact, high

Arbitrary writes into endpoint physical memory readily panic the kernel, and untranslated transactions escaping the iATU onto the internal bus can raise bus errors/aborts, crashing or hanging the endpoint system.