CVE-2025-68343

Vulnerability

In the Linux kernel's gs_usb CAN driver, the function gs_usb_receive_bulk_callback() did not verify that the received URB's actual_length was at least the size of the header of struct gs_host_frame before accessing its members. This missing length check could allow an attacker to trigger an out-of-bounds read if a short URB is received [1][2][3][4].

Exploitation

An attacker with physical or local USB access to a system using a gs_usb-based CAN adapter could craft a malicious USB device that sends a URB with insufficient length. No authentication is required, and the attack can be launched from a compromised or custom CAN adapter connected to the USB port.

Impact

Successful exploitation could lead to information disclosure (reading kernel memory) or a system crash (denial of service), as the driver may access memory beyond the received data [1][2][3][4].

Mitigation

The fix introduces a struct_group to define the header and adds a check that the received data is at least the header size before accessing members. Additionally, the code now uses parent->hf_size_rx instead of the unsafe dev->parent->hf_size_rx to avoid a NULL pointer dereference when the URB is short. Patches are available in the stable kernel trees [1][2][3][4]. Users should update to a kernel version containing these commits.