CVE-2019-3701

Published: 3 January 2019

An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user "root" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.

From the Ubuntu Security Team

Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code.

Notes

The original CVE description that states that an unprivileged user
can trigger a system crash is incorrect. Only the root user, from the init
namespace, can trigger the system crash. Therefore, we'll prioritize this
issue as negligible.

Status

Severity score breakdown

References

• https://marc.info/?l=linux-netdev&m=154659326324991&w=2
• https://marc.info/?l=linux-can&m=154659326224990&w=2
• https://ubuntu.com/security/notices/USN-3932-1
• https://ubuntu.com/security/notices/USN-3932-2
• https://ubuntu.com/security/notices/USN-4115-1
• https://ubuntu.com/security/notices/USN-4118-1
• https://www.cve.org/CVERecord?id=CVE-2019-3701
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=1120386