CVE-2024-23851

What it actually does

The flaw in copy_params allows a local process to supply an ioctl request to dm-ioctl that requests an allocation larger than INT_MAX bytes because the param_kernel->data_size field is not validated, resulting in an oversized kmalloc attempt that crashes the kernel.

Why it matters to the business

Local users on affected systems can trigger a kernel panic, causing immediate system downtime, loss of running workloads, and the need for manual recovery or reboot.

How an attack unfolds

An attacker with a local shell crafts a malformed struct dm_ioctl containing an excessively large data_size value, issues the corresponding device-mapper ioctl, and triggers the unchecked allocation path that forces the kernel to panic.

How to fix it

Upgrade the Linux kernel to a version newer than 6.7.1 that contains the missing data_size validation; rebuild and reboot into the fixed kernel.

How to confirm the fix worked

Verify the running kernel version is newer than 6.7.1; confirm the presence of the data_size bounds check in drivers/md/dm-ioctl.c; attempt to reproduce the oversized allocation from a non-privileged account and ensure the call is now rejected.

Typical attack path

1. Obtain a local shell or process on the target host
2. Locate a device-mapper control device (/dev/mapper/control)
3. Construct and submit an ioctl with oversized data_size via the dm-ioctl interface
4. Trigger kernel memory allocation failure leading to panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages originating from dm-ioctl.c or copy_params; correlate with process activity that opens /dev/mapper/control and issues ioctls.

What your security team should do

• Prioritize kernel package updates on all affected hosts
• Limit untrusted local accounts and container workloads that can issue device-mapper ioctls
• Enable kernel panic logging and monitoring to detect exploitation attempts