In the Linux kernel, the following vulnerability has been resolved:
can: af_can: fix NULL pointer dereference in can_rcv_filter
Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer
dereference in can_rx_register()") we need to check for a missing
initialization of ml_priv in the receive path of CAN frames.
Since commit 4e096a18867a ("net: introduce CAN specific pointer in the
struct net_device") the check for dev->type to be ARPHRD_CAN is not
sufficient anymore since bonding or tun netdevices claim to be CAN
devices but do not initialize ml_priv accordingly.
References
Configurations
Configuration 1 (hide)
|
History
25 Oct 2024, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: af_can: fix NULL pointer dereference in can_rcv_filter De manera análoga a el commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()"), debemos comprobar si falta una inicialización de ml_priv en la ruta de recepción de los marcos CAN. Desde el commit 4e096a18867a ("net: introduzca el puntero específico de CAN en la estructura net_device"), la verificación de que dev->type sea ARPHRD_CAN ya no es suficiente ya que los dispositivos de red vinculados o sintonizados afirman ser dispositivos CAN pero no inicializan ml_priv en consecuencia. | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-476 | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/0acc442309a0a1b01bcdaa135e56e6398a49439c - Patch | |
| References | () https://git.kernel.org/stable/c/3982652957e8d79ac32efcb725450580650a8644 - Patch | |
| References | () https://git.kernel.org/stable/c/c142cba37de29f740a3852f01f59876af8ae462a - Patch | |
| References | () https://git.kernel.org/stable/c/c42221efb1159d6a3c89e96685ee38acdce86b6f - Patch | |
| References | () https://git.kernel.org/stable/c/fcc63f2f7ee3038d53216edd0d8291e57c752557 - Patch |
23 Oct 2024, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
21 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-21 20:15
Updated : 2024-10-25 18:47
NVD link : CVE-2022-48977
Mitre link : CVE-2022-48977
CVE.ORG link : CVE-2022-48977
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference