CVE-2019-3701

Summary

CVE	CVE-2019-3701
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-01-03 16:29:00 UTC
Updated	2019-09-03 00:15:00 UTC
Description	An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user "root" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.

Risk And Classification

Problem Types: CWE-787

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All

References

Reference	Source	Link	Tags
[security-announce] openSUSE-SU-2020:0543-1: important: Security update	SUSE	lists.opensuse.org
kernel/git/netdev/net.git - Netdev Group's networking tree	MISC	git.kernel.org	Mailing List, Patch, Vendor Advisory
support.f5.com/csp/article/K17957133	CONFIRM	support.f5.com	Third Party Advisory
USN-3932-2: Linux kernel (Xenial HWE) vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
[SECURITY] [DLA 1731-2] linux regression update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
[SECURITY] [DLA 1771-1] linux-4.9 security update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
USN-3932-1: Linux kernel vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
USN-4118-1: Linux kernel (AWS) vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
'[PATCH v3] can: gw: ensure DLC boundaries after CAN frame modification' - MARC	MISC	marc.info	Mailing List, Patch, Third Party Advisory
Linux Kernel 'can_can_gw_rcv in net/can/gw.c' Local Denial of Service Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
[SECURITY] [DLA 1731-1] linux security update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
'[PATCH] can: gw: ensure DLC boundaries after CAN frame modification' - MARC	MISC	marc.info	Patch, Third Party Advisory
USN-4115-1: Linux kernel vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
Bug 1120386 – VUL-0: CVE-2019-3701: kernel: crash in CAN driver	MISC	bugzilla.suse.com	Exploit, Issue Tracking, Patch, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

750691 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2020:1141-1)