Use After Free Vulnerability in m_can
Summary
GSD-2022-1001924: can: m_can: m_can_tx_handler(): fix use after free of skb. Affects Kernel versions >= 80646733f11c2e9de3b6339f7e635047e6087280, < f43e64076ff1b1dcb893fb77ad1204105f710a29. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The m_can package is a part of the Linux Kernel ecosystem and is responsible for handling Controller Area Network (CAN) communication. CAN is a widely used protocol for communication between microcontrollers and devices in automotive and industrial applications. The m_can package provides the necessary functionality for transmitting and receiving CAN messages. However, a vulnerability has been discovered in the m_can_tx_handler() function, which can lead to a use after free of skb (socket buffer) objects.
Vulnerability Detail
The use after free vulnerability in m_can_tx_handler() occurs when the function attempts to access a socket buffer object that has already been freed. This can happen if the object is freed before the function completes its execution. An attacker can potentially exploit this vulnerability to execute arbitrary code or cause a denial of service by manipulating the freed skb object. The vulnerability was introduced in version v3.18 of the Linux Kernel and is fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to the affected version of the Linux Kernel. The patch can be obtained from the commit f43e64076ff1b1dcb893fb77ad1204105f710a29 in the Linux Kernel repository. Here is an example of how to apply the patch:
- Clone the Linux Kernel repository: git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Checkout the affected version: git checkout v3.18
- Apply the patch: git cherry-pick f43e64076ff1b1dcb893fb77ad1204105f710a29
- Recompile and install the patched kernel.
Conclusion
The use after free vulnerability in m_can_tx_handler() of the m_can package in the Linux Kernel can have serious security implications. It is crucial to update to the fixed version of the Linux Kernel to mitigate the risk of arbitrary code execution or denial of service attacks. Applying the provided patch or obtaining the updated kernel from the official repository are recommended steps. If you need further assistance, feel free to contact DevNack.com for support on vulnerability remediation.
See every vulnerability recorded for Kernel →
FAQ
The use after free vulnerability in m_can_tx_handler() can potentially allow an attacker to execute arbitrary code or cause a denial of service. It is important to update to the fixed version of the Linux Kernel to mitigate this risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to the network. Attackers can send specially crafted CAN messages to trigger the use after free condition and potentially execute arbitrary code.
There are no known instances of this vulnerability being exploited in the wild. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
For further support on vulnerability remediation and assistance with updating the Linux Kernel, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
