CVE-2022-48830

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: fix potential CAN frame reception race in isotp_rcv()

When receiving a CAN frame the current code logic does not consider

concurrently receiving processes which do not show up in real world

usage.

Ziyang Xuan writes:

The following syz problem is one of the scenarios. so->rx.len is

changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals

0 before alloc_skb() and equals 4096 after alloc_skb(). That will

trigger skb_over_panic() in skb_put().

=======================================================

CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0

RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113

Call Trace:

<TASK>

skb_over_panic net/core/skbuff.c:118 [inline]

skb_put.cold+0x24/0x24 net/core/skbuff.c:1990

isotp_rcv_cf net/can/isotp.c:570 [inline]

isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668

deliver net/can/af_can.c:574 [inline]

can_rcv_filter+0x445/0x8d0 net/can/af_can

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References