CVE-2024-23851: Integer Overflow
copyparams in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INTMAX bytes and crash because of a missing paramkernel->datasize check. This is related to ctlioctl.
Other sources
copyparams in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INTMAX bytes, and crash, because of a missing paramkernel->datasize check. This is related to ctlioctl.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23851?
CVE-2024-23851 is categorized as a critical vulnerability due to its potential to cause system crashes.
How do I fix CVE-2024-23851?
To fix CVE-2024-23851, upgrade to a patched version of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What versions of the Linux kernel are affected by CVE-2024-23851?
CVE-2024-23851 affects the Linux kernel versions up to and including 6.7.1.
What components are involved in CVE-2024-23851 vulnerability?
CVE-2024-23851 involves the copy_params function in drivers/md/dm-ioctl.c related to missing data_size checks.
Can CVE-2024-23851 lead to remote exploits?
CVE-2024-23851 primarily causes local crashes rather than remote exploitation.