Out-of-Bounds Read in Linux Kernel Affects Virtual CAN Interfaces

CVE-2022-49844

What is CVE-2022-49844?

A vulnerability in the Linux kernel can lead to out-of-bounds reads on virtual CAN interfaces, specifically vcan and vxcan. This issue occurs when the 'priv->ctrlmode' element is accessed on interfaces that do not initialize the 'struct can_priv', resulting in potential data leakage and CAN frame drops. The original commit was reverted, and a new helper function was introduced to mitigate this flaw in CAN interface drivers.

References