Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-48977: Linux kernel CAN networking may crash
CVE-2022-48977 · published 2 years ago
Summary
The Linux kernel's CAN (Controller Area Network) support can crash if a certain network device type receives CAN messages without proper setup. This happens because a required internal pointer is not initialized, leading to a system error. Apply the latest kernel updates from your Linux distribution to include the fix.
What to do
- Update linux kernel to version 6.0.13.
- Update debian linux to version 6.1.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.4.110, < 5.4.227 >= 5.10.28, < 5.10.159 >= 5.11.12, < 5.15.83 >= 5.16, < 6.0.13 6.1 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 5.12.0, < 6.0.13 Fix: upgrade to 6.0.13
|
| Debian:12 | debian | linux |
< 6.1.4-1 Fix: upgrade to 6.1.4-1
|
Original advisory text
can: af_can: fix NULL pointer dereference in can_rcv_filter
In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") we need to check for a missing initialization of ml_priv in the receive path of CAN frames. Since commit 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") the check for dev->type to be ARPHRD_CAN is not sufficient anymore since bonding or tun netdevices claim to be CAN devices but do not initialize ml_priv accordingly.
References
- https://git.kernel.org/stable/c/fcc63f2f7ee3038d53216edd0d8291e57c752557 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48977... Vendor Advisory
- https://git.kernel.org/stable/c/0acc442309a0a1b01bcdaa135e56e6398a49439c URL
- https://git.kernel.org/stable/c/3982652957e8d79ac32efcb725450580650a8644 URL
- https://git.kernel.org/stable/c/c142cba37de29f740a3852f01f59876af8ae462a URL
- https://git.kernel.org/stable/c/c42221efb1159d6a3c89e96685ee38acdce86b6f URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-48977 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2022-48977 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published21 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta