CVE-2023-54039

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access

In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access

could occur during the memcpy() operation if the size of skb->cb is

larger than the size of struct j1939_sk_buff_cb. This is because the

memcpy() operation uses the size of skb->cb, leading to a read beyond

the struct j1939_sk_buff_cb.

Updated the memcpy() operation to use the size of struct

j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the

memcpy() operation only reads the memory within the bounds of struct

j1939_sk_buff_cb, preventing out-of-bounds memory access.

Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb

is greater than or equal to the size of struct j1939_sk_buff_cb. This

ensures that the skb->cb buffer is large enough to hold the

j1939_sk_buff_cb structure.

[mkl: rephrase commit message]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References