Timestamp Overflow Vulnerability in Linux Kernel CAN Module
Summary
CVE-2022-49659: In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits In commit 1be37d3b0414 ("can: m_can: fix periph RX path: use rx-offload t... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The CAN (Controller Area Network) module in the Linux kernel facilitates communication between devices in automotive and industrial applications. This vulnerability specifically affects the m_can module, which handles CAN communication, and is critical for ensuring accurate timestamping of received frames.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49659, arises from the m_can module's handling of timestamps. The module originally utilized 16-bit timestamps, which are insufficient for RX-offload operations that expect 32-bit timestamps. This discrepancy can lead to incorrect timestamp handling, potentially causing data integrity issues in CAN communications. The issue was introduced in commit 1be37d3b0414, which switched the RX path for peripheral devices to RX-offload, thus exposing the vulnerability.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2022-49659 is a significant vulnerability in the Linux kernel's m_can module that affects timestamp handling. Users are advised to update to the patched version 5.18.14-1 to ensure the integrity of CAN communications. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49659 is a vulnerability in the Linux kernel's m_can module that affects timestamp handling, potentially leading to data integrity issues.
If your system uses the m_can module for CAN communications, this vulnerability could result in incorrect timestamps, affecting the reliability of data transmission.
Yes, the patched version of the Linux kernel is 5.18.14-1. Users should update to this version to mitigate the vulnerability.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities. It requires only a manifest file like package-lock.json to provide real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
