Out-of-Bounds Read Vulnerability in Linux Kernel CAN Interface - CVE-2022-49844
Summary
CVE-2022-49844: In the Linux kernel, the following vulnerability has been resolved: can: dev: fix skb drop check In commit a6d190f8c767 ("can: skb: drop tx skb if in listen only mode") the priv->ctrlmode element is read even on virtual... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports various functionalities, including device drivers, file systems, and network protocols. The CAN (Controller Area Network) subsystem within the Linux kernel enables communication between microcontrollers and devices without a host computer. This vulnerability specifically affects virtual CAN interfaces, such as vcan and vxcan, which are used for testing and simulation purposes.
Vulnerability Detail
CVE-2022-49844 is a vulnerability in the Linux kernel's CAN subsystem, where an out-of-bounds read occurs due to the improper handling of the priv->ctrlmode element on virtual CAN interfaces. This issue arises from a commit that did not account for the absence of the struct can_priv on these interfaces. The potential ramifications include CAN frame drops, which can disrupt communication in applications relying on virtual CAN interfaces, leading to data loss or system instability.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for updates and apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49844 represents a significant vulnerability in the Linux kernel's CAN subsystem, particularly affecting virtual CAN interfaces. Users are strongly encouraged to update their kernel to the patched version to prevent potential communication disruptions. Regular monitoring for vulnerabilities using tools like Vulert can further enhance system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49844 is a vulnerability in the Linux kernel's CAN subsystem that allows for an out-of-bounds read, potentially leading to CAN frame drops on virtual CAN interfaces.
This vulnerability can cause communication disruptions in applications that utilize virtual CAN interfaces, leading to data loss or instability.
If you are using a version of the Linux kernel prior to 6.0.10-1, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can also use the Vulert playground to check if your application is affected by this vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for updates and apply the patch as soon as it is available to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
