CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's dm-pcache component, where an unchecked segment number (seg_num) can lead to out-of-bounds writes in the kernel heap during cache initialization. This flaw allows an attacker with CAP_SYS_ADMIN privileges to manipulate the cache device, potentially leading to memory corruption and system instability. System administrators and developers managing Linux environments should prioritize addressing this vulnerability to mitigate risks associated with unauthorized memory access and potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg_num against the cache device size seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR. Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.