CVE-2023-52429

What it actually does

Missing validation of struct dm_ioctl.target_count in dm_table_create allows alloc_targets to request more than INT_MAX bytes, resulting in allocation failure and kernel crash.

Why it matters to the business

Systems using device-mapper targets may experience sudden kernel crashes and reboots when a local user issues crafted ioctls, leading to unplanned downtime and loss of availability on affected Linux hosts.

How an attack unfolds

An attacker with local access crafts a dm_ioctl structure containing an oversized target_count value, invokes the device-mapper ioctl path, and triggers the unchecked allocation inside dm_table_create that exceeds INT_MAX and crashes the kernel.

How to fix it

Update the Linux kernel to a version containing commit bd504bcfec41a503b32054da5472904b404341a4 or later; rebuild and deploy the fixed kernel image, then reboot systems.

How to confirm the fix worked

Verify the running kernel contains commit bd504bcfec41a503b32054da5472904b404341a4 via git log or kernel version string; attempt to reproduce the crash with a test program that supplies a large target_count and confirm the kernel no longer panics.

Typical attack path

1. Obtain local shell or process execution on the target host
2. Open /dev/mapper/control or a dm device
3. Prepare dm_ioctl with target_count set larger than INT_MAX / sizeof(struct dm_target_spec)
4. Issue DM_TABLE_LOAD or equivalent ioctl
5. Trigger allocation failure and kernel panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for device-mapper allocation failures or panic messages referencing dm_table_create or dm_ioctl; correlate with user processes issuing ioctls on dm devices.

What your security team should do

• Prioritize kernel upgrade on all production systems using device-mapper
• Apply the fix containing bd504bcfec41a503b32054da5472904b404341a4 within standard change windows
• Monitor kernel crash logs for device-mapper related panics until patches are deployed