270 lines
14 KiB
JSON
270 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49844",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-05-01T14:05:17.229Z",
|
||
"datePublished": "2025-05-01T14:09:58.999Z",
|
||
"dateUpdated": "2026-08-05T08:56:26.437Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:56:26.437Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: fix skb drop check\n\nIn commit a6d190f8c767 (\"can: skb: drop tx skb if in listen only\nmode\") the priv->ctrlmode element is read even on virtual CAN\ninterfaces that do not create the struct can_priv at startup. This\nout-of-bounds read may lead to CAN frame drops for virtual CAN\ninterfaces like vcan and vxcan.\n\nThis patch mainly reverts the original commit and adds a new helper\nfor CAN interface drivers that provide the required information in\nstruct can_priv.\n\n[mkl: patch pch_can, too]"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
|
||
"baseScore": 7.1,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is triggered by transmitting on virtual CAN interfaces (vcan/vxcan) via AF_CAN or packet sockets, which requires local system access rather than remote network or adjacent CAN-bus reachability.\nAC:L - An attacker who can send on a vcan/vxcan interface reliably hits the bad `priv->ctrlmode` read on every TX; no race or uncontrolled external condition is required.\nPR:L - An unprivileged user can create vcan in a user namespace (CAP_NET_ADMIN via userns) or send on an existing vcan with AF_CAN, which needs no elevated capability beyond a basic local account.\nUI:N - Exploitation requires only attacker-controlled socket sends on the virtual CAN device; no victim action is needed.\nS:U - Impact remains within the local kernel/host authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - The defect is a CWE-125 out-of-bounds/wrong-object read of kernel memory via a miscast `can_priv`; per kernel OOB-read guidance this is scored High when severity is uncertain.\nI:N - The bad access is read-only and only influences whether an skb is dropped; it provides no write primitive or control-flow hijack.\nA:H - When the misread bits look like CAN_CTRLMODE_LISTENONLY, TX frames on vcan/vxcan are dropped, enabling a complete DoS of that interface’s transmit path."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/can/at91_can.c",
|
||
"drivers/net/can/c_can/c_can_main.c",
|
||
"drivers/net/can/can327.c",
|
||
"drivers/net/can/cc770/cc770.c",
|
||
"drivers/net/can/ctucanfd/ctucanfd_base.c",
|
||
"drivers/net/can/dev/skb.c",
|
||
"drivers/net/can/flexcan/flexcan-core.c",
|
||
"drivers/net/can/grcan.c",
|
||
"drivers/net/can/ifi_canfd/ifi_canfd.c",
|
||
"drivers/net/can/janz-ican3.c",
|
||
"drivers/net/can/kvaser_pciefd.c",
|
||
"drivers/net/can/m_can/m_can.c",
|
||
"drivers/net/can/mscan/mscan.c",
|
||
"drivers/net/can/pch_can.c",
|
||
"drivers/net/can/peak_canfd/peak_canfd.c",
|
||
"drivers/net/can/rcar/rcar_can.c",
|
||
"drivers/net/can/rcar/rcar_canfd.c",
|
||
"drivers/net/can/sja1000/sja1000.c",
|
||
"drivers/net/can/slcan/slcan-core.c",
|
||
"drivers/net/can/softing/softing_main.c",
|
||
"drivers/net/can/spi/hi311x.c",
|
||
"drivers/net/can/spi/mcp251x.c",
|
||
"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
|
||
"drivers/net/can/sun4i_can.c",
|
||
"drivers/net/can/ti_hecc.c",
|
||
"drivers/net/can/usb/ems_usb.c",
|
||
"drivers/net/can/usb/esd_usb.c",
|
||
"drivers/net/can/usb/etas_es58x/es58x_core.c",
|
||
"drivers/net/can/usb/gs_usb.c",
|
||
"drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c",
|
||
"drivers/net/can/usb/mcba_usb.c",
|
||
"drivers/net/can/usb/peak_usb/pcan_usb_core.c",
|
||
"drivers/net/can/usb/ucan.c",
|
||
"drivers/net/can/usb/usb_8dev.c",
|
||
"drivers/net/can/xilinx_can.c",
|
||
"include/linux/can/dev.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "a6d190f8c7670068d8c154ef8477eca07b5e3574",
|
||
"lessThan": "386c49fe31ee748e053860b3bac7794a933ac9ac",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a6d190f8c7670068d8c154ef8477eca07b5e3574",
|
||
"lessThan": "ae64438be1923e3c1102d90fd41db7afcfaf54cc",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/can/at91_can.c",
|
||
"drivers/net/can/c_can/c_can_main.c",
|
||
"drivers/net/can/can327.c",
|
||
"drivers/net/can/cc770/cc770.c",
|
||
"drivers/net/can/ctucanfd/ctucanfd_base.c",
|
||
"drivers/net/can/dev/skb.c",
|
||
"drivers/net/can/flexcan/flexcan-core.c",
|
||
"drivers/net/can/grcan.c",
|
||
"drivers/net/can/ifi_canfd/ifi_canfd.c",
|
||
"drivers/net/can/janz-ican3.c",
|
||
"drivers/net/can/kvaser_pciefd.c",
|
||
"drivers/net/can/m_can/m_can.c",
|
||
"drivers/net/can/mscan/mscan.c",
|
||
"drivers/net/can/pch_can.c",
|
||
"drivers/net/can/peak_canfd/peak_canfd.c",
|
||
"drivers/net/can/rcar/rcar_can.c",
|
||
"drivers/net/can/rcar/rcar_canfd.c",
|
||
"drivers/net/can/sja1000/sja1000.c",
|
||
"drivers/net/can/slcan/slcan-core.c",
|
||
"drivers/net/can/softing/softing_main.c",
|
||
"drivers/net/can/spi/hi311x.c",
|
||
"drivers/net/can/spi/mcp251x.c",
|
||
"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
|
||
"drivers/net/can/sun4i_can.c",
|
||
"drivers/net/can/ti_hecc.c",
|
||
"drivers/net/can/usb/ems_usb.c",
|
||
"drivers/net/can/usb/esd_usb.c",
|
||
"drivers/net/can/usb/etas_es58x/es58x_core.c",
|
||
"drivers/net/can/usb/gs_usb.c",
|
||
"drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c",
|
||
"drivers/net/can/usb/mcba_usb.c",
|
||
"drivers/net/can/usb/peak_usb/pcan_usb_core.c",
|
||
"drivers/net/can/usb/ucan.c",
|
||
"drivers/net/can/usb/usb_8dev.c",
|
||
"drivers/net/can/xilinx_can.c",
|
||
"include/linux/can/dev.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "6.0",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "6.0",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.0.9",
|
||
"lessThanOrEqual": "6.0.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.0",
|
||
"versionEndExcluding": "6.0.9"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.0",
|
||
"versionEndExcluding": "6.1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/386c49fe31ee748e053860b3bac7794a933ac9ac"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ae64438be1923e3c1102d90fd41db7afcfaf54cc"
|
||
}
|
||
],
|
||
"title": "can: dev: fix skb drop check",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"cweId": "CWE-125",
|
||
"lang": "en",
|
||
"description": "CWE-125 Out-of-bounds Read"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.1,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
|
||
"integrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-10-01T17:00:29.049207Z",
|
||
"id": "CVE-2022-49844",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-10-01T17:00:34.409Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |