CVE-2025-39987

Root

Cause

The Linux kernel's hi311x CAN driver fails to populate the net_device_ops->ndo_change_mtu() callback. This omission allows an attacker to configure an arbitrarily large MTU on the CAN interface (e.g., ip link set can0 mtu 9999). When combined with a PF_PACKET socket using the ETH_P_CANXL protocol, the attacker can bypass the CAN framework's validation and directly inject a crafted CAN XL frame into the driver's xmit() function [1][2][3].

Exploitation

To exploit the vulnerability, an attacker must have the capability to open a raw PF_PACKET socket and modify the interface MTU (typically requiring CAP_NET_ADMIN or root privileges). After setting an oversized MTU, the attacker sends a CAN XL frame with a malicious flags field (e.g., 0xff) and a len field of 2048. The driver's can_dev_dropped_skb() check only verifies that the skb protocol is ETH_P_CANXL and that the length is valid for CAN XL, but it does not verify the actual device capabilities. Consequently, the frame reaches hi3110_hard_start_xmit(), which misinterprets the CAN XL frame as a standard CAN frame and passes the frame->len (which is actually the flags field) directly to hi3110_hw_tx() [1][2][3].

Impact

In hi3110_hw_tx(), the driver performs a memcpy with frame->len as the copy size: memcpy(buf + HI3110_FIFO_EXT_DATA_OFF, frame->data, frame->len). Since frame->len is controlled by the attacker (e.g., 0xff = 255 bytes), but the expected maximum is 8 bytes, this results in a buffer overflow of 247 bytes beyond the intended buffer. This overflow can corrupt adjacent kernel memory, potentially leading to a denial of service (system crash) or, under specific conditions, arbitrary code execution [1][2][3].

Mitigation

The vulnerability is fixed by populating ndo_change_mtu() to restrict the MTU to CAN_MTU (the maximum size for a standard CAN frame). This prevents the attacker from setting an invalid MTU and thus blocks the attack vector. The fix has been applied to the Linux kernel stable branches; users should update to the latest patched kernels [1][2][3].