298 lines
15 KiB
JSON
298 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-72114",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-08-09T03:40:39.906Z",
|
|
"datePublished": "2026-08-15T05:52:54.750Z",
|
|
"dateUpdated": "2026-10-16T18:44:56.572Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-19T16:36:00.857Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: validate frame length in bcm_rx_setup() for RTR replies\n\nbcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits\nbefore installing frames for TX_SETUP, but bcm_rx_setup() never did\nthe same for the RTR-reply frame configured via RX_SETUP with\nRX_RTR_FRAME."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The missing validation is in bcm_rx_setup(), reached only via local PF_CAN SOCK_DGRAM CAN_BCM syscalls (socket/connect/sendmsg RX_SETUP with RX_RTR_FRAME); it is not triggered by remote IP services or by CAN bus traffic alone.\nAC:L - An attacker reliably installs a malformed RTR-reply frame with a single RX_SETUP sendmsg and can trigger bcm_can_tx() by sending or waiting for a matching RTR on the bound interface, with no races or layout dependencies beyond their control.\nPR:L - can_create(), bcm_connect(), and bcm_sendmsg() perform no capability checks; any local user with access to a CAN interface (including vcan created with CAP_NET_ADMIN in an unprivileged user namespace) can open BCM sockets and program RX_SETUP RTR replies.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending RX_SETUP messages; no victim interaction such as mounting filesystems or opening files is needed once local CAN access exists.\nS:U - Impact is kernel memory corruption and unauthorized CAN frame transmission within the same host security domain; it does not cross VM, container, or IOMMU boundaries even when frames reach an adjacent vehicle or industrial CAN segment.\nC:H - Unvalidated cf->len values are stored in op->frames and later passed to bcm_can_tx()/can_send(); many CAN driver ndo_start_xmit paths memcpy(cf->data, cf->len) trusting len, enabling out-of-bounds kernel reads when invalid lengths bypass or race skb validation.\nI:H - Attacker-controlled len in the RTR-reply frame can drive out-of-bounds memcpy writes in CAN USB/SPI/hardware xmit paths and inject attacker-crafted frame payloads onto safety-critical automotive, factory, or embedded CAN buses when RTR requests are answered.\nA:H - Out-of-bounds accesses in CAN driver transmit paths from trusted-but-invalid len values can cause kernel WARN/Oops/panic on hardened builds, and repeated malformed RTR-reply transmission attempts can wedge TX queues or disrupt CAN service on affected systems."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/can/bcm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "204f2b232717bc470ddb9e1da1d27dd9c6ef0caa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "e061624c0a86c3c26a2bf017e432fbc93ad68f3a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "7d966cdee006911d3957e1a4e72cb93c39cd8c1e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "1b475c0c72f44622a320a4386ce9e76f85e69bc7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "deb6a697cce3f021e731df543597f37a5e54caab",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "59bfddea64159594feb62ef11b7d7a33c8ee3783",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
|
|
"lessThan": "62ec41f364648be79d54d94d0d240ee326948afd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/can/bcm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.25",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.25",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.265",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.216",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.183",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.148",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.101",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.42",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.5",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.10.265"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.15.216"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.1.183"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.6.148"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.12.101"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.18.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.1.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/204f2b232717bc470ddb9e1da1d27dd9c6ef0caa"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e061624c0a86c3c26a2bf017e432fbc93ad68f3a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7d966cdee006911d3957e1a4e72cb93c39cd8c1e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1b475c0c72f44622a320a4386ce9e76f85e69bc7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/deb6a697cce3f021e731df543597f37a5e54caab"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/59bfddea64159594feb62ef11b7d7a33c8ee3783"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/62ec41f364648be79d54d94d0d240ee326948afd"
|
|
}
|
|
],
|
|
"title": "can: bcm: validate frame length in bcm_rx_setup() for RTR replies",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-72114",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T18:41:46.302799Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-16T18:44:56.572Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |