dm_table_create in drivers/md/dm-table.c in the Linux kernel up to and including 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
linux linux kernel |
||
fedoraproject fedora 38 |
||
fedoraproject fedora 39 |