CVE-2010-2959: Integer Overflow
Description of problem: Discovered by Ben Hawkes, this patch adds a limit for nframes as the number of frames in TXSETUP and RXSETUP are derived from a single byte multiplex value by default. Use-cases that would require to send/filter more than 256 CAN frames should be implemented in userspace for complexity reasons anyway. Additionally the assignments of unsigned values from userspace to signed values in kernelspace and vice versa are fixed by using unsigned values in kernelspace consistently.
Upstream commit: http://git.kernel.org/linus/5b75c4973ce779520b9d1e392483207d6f842cde
Other sources
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2959?
CVE-2010-2959 has a severity rating that indicates a potential risk to systems that use affected versions of the Linux kernel.
How do I fix CVE-2010-2959?
To fix CVE-2010-2959, users should upgrade to a version of the Linux kernel that is not vulnerable, specifically versions greater than 2.6.35.4.
What systems are affected by CVE-2010-2959?
CVE-2010-2959 affects various versions of the Linux kernel, particularly those below 2.6.35.4, as well as specific distributions like Debian, Fedora, and openSUSE.
What is the nature of the vulnerability in CVE-2010-2959?
The vulnerability in CVE-2010-2959 relates to an integer overflow in the handling of CAN frames, which could potentially allow for the denial of service.
Is there a workaround for CVE-2010-2959?
A temporary workaround for CVE-2010-2959 would involve implementing use-cases requiring more than 256 CAN frames within userspace.