https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:30:17 +0000 https://vulnerability.circl.lu/vuln/cve-2022-49771 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm ioctl: fix misbehavior if list_versions races with module loading</p> <p>__list_versions will first estimate the required space using the &#34;dm_target_iterate(list_version_get_needed, &amp;needed)&#34; call and then will fill the space using the &#34;dm_target_iterate(list_version_get_info, &amp;iter_info)&#34; call. Each of these calls locks the targets using the &#34;down_read(&amp;_lock)&#34; and &#34;up_read(&amp;_lock)&#34; calls, however between the first and second &#34;dm_target_iterate&#34; there is no lock held and the target modules can be loaded at this point, so the second &#34;dm_target_iterate&#34; call may need more space than what was the first &#34;dm_target_iterate&#34; returned.</p> <p>The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect.</p> <p>The code sets &#34;param-&gt;data_size = param-&gt;data_start + needed&#34; and &#34;iter_info.end = (char *)vers+len&#34; - &#34;needed&#34; is the size returned by the first dm_target_iterate call; &#34;len&#34; is the size of the buffer allocated by userspace.</p> <p>&#34;len&#34; may be greater than &#34;needed&#34;; in this case, the code will write up to &#34;len&#34; bytes into the buffer, however param-&gt;data_size is set to &#34;needed&#34;, so it may write data past the param-&gt;data_size value. The ioctl interface copies only up to param-&gt;data_size into userspace, thus part of the result will be truncated.</p> <p>Fix this bug by setting &#34;iter_info.end = (char *)vers + needed;&#34; - this guarantees that the second &#34;dm_target_iterate&#34; call wi…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm ioctl: fix misbehavior if list_versions races with module loading</p> <p>__list_versions will first estimate the required space using the &#34;dm_target_iterate(list_version_get_needed, &amp;needed)&#34; call and then will fill the space using the &#34;dm_target_iterate(list_version_get_info, &amp;iter_info)&#34; call. Each of these calls locks the targets using the &#34;down_read(&amp;_lock)&#34; and &#34;up_read(&amp;_lock)&#34; calls, however between the first and second &#34;dm_target_iterate&#34; there is no lock held and the target modules can be loaded at this point, so the second &#34;dm_target_iterate&#34; call may need more space than what was the first &#34;dm_target_iterate&#34; returned.</p> <p>The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect.</p> <p>The code sets &#34;param-&gt;data_size = param-&gt;data_start + needed&#34; and &#34;iter_info.end = (char *)vers+len&#34; - &#34;needed&#34; is the size returned by the first dm_target_iterate call; &#34;len&#34; is the size of the buffer allocated by userspace.</p> <p>&#34;len&#34; may be greater than &#34;needed&#34;; in this case, the code will write up to &#34;len&#34; bytes into the buffer, however param-&gt;data_size is set to &#34;needed&#34;, so it may write data past the param-&gt;data_size value. The ioctl interface copies only up to param-&gt;data_size into userspace, thus part of the result will be truncated.</p> <p>Fix this bug by setting &#34;iter_info.end = (char *)vers + needed;&#34; - this guarantees that the second &#34;dm_target_iterate&#34; call wi…</p> https://vulnerability.circl.lu/vuln/cve-2022-49771