Detections
Analytics

Echo: linux: security update to 6.12.15-1

medium Tenable Self-Hosted Container Security Plugin ID 460135

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR
 size/flags in pci_epc_set_bar() In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar()
 update inbound map address") set_bar() was modified to support dynamically changing the backing physical
 address of a BAR that was already configured. This means that set_bar() can be called twice, without ever
 calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This
 can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these
 missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size,
 the new address translation range will be smaller than the BAR size already determined by the host, which
 would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host
 to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the
 support for dynamically changing the physical address of a BAR. (Which was also missing.) (CVE-2024-58006)

Solution

Update the linux library and its related packages to version 6.12.15-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-58006

Plugin Details

Severity: Medium

ID: 460135

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-58006

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 2/27/2025

Reference Information

CVE: CVE-2024-58006