CVE-2022-48977: can: af_can: fix NULL pointer dereference in can_rcv_filter
In the Linux kernel, the following vulnerability has been resolved:
can: afcan: fix NULL pointer dereference in canrcvfilter
Analogue to commit 8aa59e355949 ("can: afcan: fix NULL pointer dereference in canrxregister()") we need to check for a missing initialization of mlpriv in the receive path of CAN frames.
Since commit 4e096a18867a ("net: introduce CAN specific pointer in the struct netdevice") the check for dev->type to be ARPHRDCAN is not sufficient anymore since bonding or tun netdevices claim to be CAN devices but do not initialize mlpriv accordingly.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48977?
CVE-2022-48977 has been rated as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2022-48977?
To fix CVE-2022-48977, users should update to a patched version of the Linux kernel that addresses this vulnerability.
What versions of the Linux kernel are affected by CVE-2022-48977?
CVE-2022-48977 affects Linux kernel versions between 5.4.110 and 5.4.227, 5.10.28 to 5.10.159, 5.11.12 to 5.15.83, and 5.16 to 6.0.13, as well as various 6.1 release candidates.
What causes the vulnerability CVE-2022-48977?
CVE-2022-48977 is caused by a NULL pointer dereference in the can_rcv_filter function in the Linux kernel.
Is CVE-2022-48977 exploitable remotely?
CVE-2022-48977 can potentially be exploited remotely depending on the configuration of the affected systems and how they handle CAN (Controller Area Network) traffic.