Linux Kernel CAN Receive Path NULL Pointer Dereference Enables Local DoS
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Feb 20, 2024
A flaw in the Linux kernel CAN networking receive path, tracked as CVE-2023-2166, can allow a local low-privileged user to crash an affected system. The defect occurs when can_rcv_filter handles received CAN frames and dereferences the CAN-specific ml_priv pointer without confirming it was initialized, resulting in a NULL-pointer dereference and denial of service.
The condition can arise because bonding or TUN network devices may report the CAN hardware type (ARPHRD_CAN) without initializing ml_priv; the issue was reported by syzbot and Wei Chen and fixed upstream by adding the required initialization check. Red Hat rates the issue CVSS 5.5 (Moderate), with availability impact only, and released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems in errata including RHSA-2024:0461, RHSA-2024:0881, and RHSA-2024:0897.
