Use After Free Vulnerability in m_can
Summary
GSD-2022-1001309: can: m_can: m_can_tx_handler(): fix use after free of skb. Affects Kernel versions >= 80646733f11c2e9de3b6339f7e635047e6087280, < 31417073493f302d26ab66b3abc098d43227b835. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The m_can package is a component of the Linux Kernel that provides support for the Controller Area Network (CAN) protocol. CAN is a widely used communication protocol in automotive and industrial applications. The m_can_tx_handler() function in the m_can module is responsible for handling transmission requests. However, a vulnerability has been discovered in this function that can lead to a use after free of skb (socket buffer) object. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The use after free vulnerability in m_can_tx_handler() occurs when the function attempts to access a socket buffer object that has already been freed. This can happen if the skb object is freed before it is no longer needed, but a reference to it is still present. An attacker can potentially exploit this vulnerability by manipulating the freed skb object to execute arbitrary code or crash the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply patches or backports provided by the Linux distribution maintainers. These patches may include the necessary fixes for the use after free vulnerability in m_can_tx_handler(). It is recommended to consult the official documentation and support channels of the specific Linux distribution for detailed instructions on applying patches or backports.
Conclusion
The use after free vulnerability in m_can_tx_handler() can pose a significant security risk to systems utilizing the m_can package. It is crucial to update the Linux Kernel to the latest version that includes the fix for this vulnerability. Applying patches or backports provided by the Linux distribution maintainers can also serve as a temporary workaround. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
m_can is a component of the Linux Kernel that provides support for the Controller Area Network (CAN) protocol. CAN is widely used in automotive and industrial applications for reliable communication between electronic control units.
A use after free vulnerability occurs when a program attempts to access memory that has already been freed. In the case of the m_can_tx_handler() function, it can lead to the exploitation of a freed socket buffer object, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
The impact of this vulnerability can vary depending on the specific exploitation scenario. In the worst case, an attacker may be able to execute arbitrary code with elevated privileges or crash the system, leading to a denial of service.
You can use tools like Vulert to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
For more information about the fix for this vulnerability, you can refer to the official Linux Kernel documentation and the commit 31417073493f302d26ab66b3abc098d43227b835 in the Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
