PT-2025-8787 · Linux+1 · Linux Kernel+1

Published 2024-12-23 · Updated 2025-02-28 · CVE-2024-58000

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, specifically in the io uring component. The issue allowed for reg-wait speculations, which could be exploited by passing a user pointer with arguments for the waiting loop. To address this, the kernel now uses the array index nospec() function to prevent speculation type exploits when accessing a kernel array using a user-given index. The fix also ensures that only the maximum offset allowed, considering the structure size, is passed instead of the full region size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-03993

CVE-2024-58000

Affected Products

Astra Linux

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58000.json · Exploit
• https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a · Patch
• https://osv.dev/vulnerability/CVE-2024-58000 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-58000 · Security Note
• https://ubuntu.com/security/CVE-2024-58000 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-58000 · Vendor Advisory
• https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1 · Patch
• https://bdu.fstec.ru/vul/2026-03993 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-58000 · Security Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.2 · Note
• https://twitter.com/CVEnew/status/1895619380219986125 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2025022642-CVE-2024-58000-4f74@gregkh · Note
• https://git.kernel.org/linus/29b95ac917927ce9f95bf38797e16333ecb489b1 · Note