Race Condition Vulnerability in isotp_rcv() Function of Kernel
Summary
GSD-2022-1000485: can: isotp: fix potential CAN frame reception race in isotp_rcv(). Affects Kernel versions >= e057dd3fc20ffb3d7f150af46542a51b59b90127, < 5b068f33bc8acfcfd5ea7992a2dafb30d89bad30. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core services for managing system resources and facilitating communication between hardware and software. It is responsible for managing processes, memory, file systems, and device drivers. The isotp_rcv() function is part of the Controller Area Network (CAN) subsystem in the Kernel, specifically the ISO-TP (ISO 15765-2) protocol implementation. ISO-TP is used for transmitting large data payloads over CAN bus networks. The isotp_rcv() function is responsible for receiving CAN frames and handling ISO-TP protocol operations.
Vulnerability Detail
The isotp_rcv() function in the Kernel is vulnerable to a race condition during CAN frame reception. A race condition occurs when multiple threads or processes access shared resources concurrently, leading to unexpected behavior or security vulnerabilities. In this case, the race condition can occur if two or more threads attempt to receive CAN frames simultaneously. This can result in incorrect handling of ISO-TP protocol operations, potentially leading to data corruption, denial of service, or even remote code execution. The vulnerability was introduced in Kernel version v5.10 and is fixed in version v5.16.10.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the ISO-TP protocol or avoid scenarios where multiple threads or processes attempt to receive CAN frames simultaneously. However, this may impact the functionality or performance of systems relying on ISO-TP communication.
Conclusion
The race condition vulnerability in the isotp_rcv() function of the Kernel can potentially lead to data corruption, denial of service, or remote code execution. It is crucial to update the Kernel to version v5.16.10 or later to mitigate this vulnerability. Users can also utilize the Vulert Playground (https://vulert.com/scanner) to check if their system is affected and obtain further support on vulnerability remediation.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to data corruption, denial of service, or remote code execution, depending on the specific circumstances and attacker capabilities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for known vulnerabilities, including this race condition in the isotp_rcv() function.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is important to promptly apply the fix to mitigate any potential risks.
While updating the Kernel is the recommended solution, you can temporarily mitigate the vulnerability by disabling the ISO-TP protocol or avoiding scenarios where multiple threads or processes attempt to receive CAN frames simultaneously. However, this may impact the functionality or performance of systems relying on ISO-TP communication.
You can find more information about the fix in the Linux Kernel source code repository. The specific commit that addresses this vulnerability is 5b068f33bc8acfcfd5ea7992a2dafb30d89bad30.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
