CVE-2023-54039

Vulnerability

In the Linux kernel's CAN J1939 protocol implementation, the function j1939_tp_tx_dat_new() contains an out-of-bounds memory access vulnerability. The issue occurs during a memcpy() operation that uses the size of skb->cb (the control buffer of a socket buffer) instead of the intended size of struct j1939_sk_buff_cb. This mismatch can lead to reading beyond the bounds of the smaller structure, potentially causing memory corruption or information disclosure [1].

Exploitation

To exploit this vulnerability, an attacker would need to have the ability to send crafted CAN J1939 CAN frames, which typically requires local access to the system or the ability to interact with the CAN bus. The bug is triggered during the transmission of data packets, specifically when the kernel allocates and initializes a new transport protocol data unit. No special privileges beyond the ability to use J1939 sockets are required, but the attacker must be able to craft CAN frames that trigger the vulnerable code path [1].

Impact

Successful exploitation could lead to memory corruption, potentially allowing an attacker to crash the system (denial of service) or, in more likely than arbitrary code execution. The out-of-bounds read may also expose sensitive kernel memory. The vulnerability is considered moderate severity due to the local access requirement and the specific conditions needed to trigger it [1].

Mitigation

The fix has been applied to the Linux kernel stable tree. The patch updates the memcpy() to use the correct size (sizeof(struct j1939_sk_buff_cb)) and adds a BUILD_BUG_ON() compile-time check to ensure the control buffer is large enough. Users should update their kernel to a version containing this commit or apply the backported patch [1][2][3].