Vulnerability Details : CVE-2024-23851
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.
Products affected by CVE-2024-23851
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2024-23851
0.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 3 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-23851
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | 2024-01-29 |
References for CVE-2024-23851
-
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
[SECURITY] [DLA 3840-1] linux security update
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/
[SECURITY] Fedora 39 Update: kernel-6.7.6-200.fc39 - package-announce - Fedora Mailing-Lists
-
https://www.spinics.net/lists/dm-devel/msg56574.html
[LInux Kernel Crash] "WARNING: kmalloc bug in ctl_ioctl" — Fedora Linux UsersMailing List;Third Party Advisory
-
https://www.spinics.net/lists/dm-devel/msg56694.html
Re: [LInux Kernel Crash] "WARNING: kmalloc bug in ctl_ioctl" — Fedora Linux UsersMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
[SECURITY] [DLA 3842-1] linux-5.10 security update
Jump to