{"uuid": "fff1f28d-175e-4db7-998f-ca990a5b5671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-58000", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14768", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-58000\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: prevent reg-wait speculations\n\nWith *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments\nfor the waiting loop the user can specify an offset into a pre-mapped\nregion of memory, in which case the\n[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the\nargument.\n\nAs we address a kernel array using a user given index, it'd be a subject\nto speculation type of exploits. Use array_index_nospec() to prevent\nthat. Make sure to pass not the full region size but truncate by the\nmaximum offset allowed considering the structure size.\n\ud83d\udccf Published: 2025-02-27T02:07:19.155Z\n\ud83d\udccf Modified: 2025-05-04T10:08:06.384Z\n\ud83d\udd17 References:\n1. https://git.kernel.org/stable/c/2a6de94df7bfa76d9850443547e7b3333f63a16a\n2. https://git.kernel.org/stable/c/29b95ac917927ce9f95bf38797e16333ecb489b1", "creation_timestamp": "2025-05-04T10:18:06.000000Z"}