Linux Kernel Vulnerability in CAN Stack Communication Handling

CVE-2020-36789

Summary

A vulnerability in the Linux kernel's CAN stack allows for a potential NULL pointer dereference when a driver invokes the function can_get_echo_skb() during hardware IRQ contexts. This occurs particularly under conditions of network congestion. The underlying issue stems from the inappropriate use of kfree_skb() instead of the safer dev_kfree_skb_irq() function. To mitigate this, the patched version now ensures proper reference counting through skb_get() and defers the freeing of the socket buffer (skb) to more appropriate context-aware functions. Although similar concerns were flagged in 2017, this iteration specifically addresses the CAN devices' unique scenarios to enhance system stability.

References