Vulnerability in Kernel: can: isotp: sanitize CAN ID checks in isotp_bind()
Summary
GSD-2022-1001605: can: isotp: sanitize CAN ID checks in isotp_bind(). Affects Kernel versions >= e057dd3fc20ffb3d7f150af46542a51b59b90127, < cf522d741f5301223cc94b978eb1603c7590d65e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functionalities and services to ensure the proper functioning of the system. One of its features is the isotp module, which handles ISO-TP (ISO 15765-2) protocol communication over CAN (Controller Area Network). This protocol is commonly used in automotive systems for transmitting large amounts of data between electronic control units (ECUs).
Vulnerability Detail
The vulnerability identified in the isotp module of the Kernel lies in the isotp_bind() function. The function fails to properly sanitize CAN ID checks, potentially allowing an attacker to manipulate or spoof CAN IDs. This could lead to various security issues, including unauthorized access, data manipulation, or disruption of communication between ECUs. The impact and attack plausibility of this vulnerability have not been proven yet, but it poses a potential risk to the integrity and security of automotive systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the isotp module if it is not essential for their system's functionality. This can be achieved by blacklisting the module or modifying the system configuration to prevent its loading. However, this workaround may impact the functionality of applications or services that rely on the isotp module.
Conclusion
The identified vulnerability in the isotp module of the Kernel poses a potential risk to the security and integrity of automotive systems. It is crucial to update the Linux Kernel to the recommended version or apply the necessary fix to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The isotp module is a component of the Linux Kernel that handles ISO-TP (ISO 15765-2) protocol communication over CAN. It enables the transmission of large amounts of data between electronic control units (ECUs) in automotive systems.
The impact of this vulnerability could include unauthorized access, data manipulation, or disruption of communication between ECUs in automotive systems. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. This update includes the necessary fix to properly sanitize CAN ID checks in the isotp module.
As a temporary workaround, users can disable or restrict access to the isotp module if it is not essential for their system's functionality. However, this workaround may impact the functionality of applications or services that rely on the isotp module.
For more information about this vulnerability, you can refer to the provided references link in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
