CVE-2022-49845: can: j1939: j1939_send_one(): fix missing CAN header initialization
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: j1939sendone(): fix missing CAN header initialization
The read access to struct canxlframe::len inside of a j1939 created skbuff revealed a missing initialization of reserved and later filled elements in struct canframe.
This patch initializes the 8 byte CAN header with zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch can: j1939: j1939_send_one(): fix missing CAN header initialization - Configuration
Ensure j1939_send_one() initializes the 8-byte CAN header (struct can_frame header) with zero to prevent read access to uninitialized struct canxl_frame::len elements.
j1939 CAN header handling (kernel CAN subsystem) CAN header initialization (8-byte CAN header in struct can_frame) = zero-initialize reserved bytes and initialize the 8 byte CAN header with zero
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49845?
The severity of CVE-2022-49845 has been classified as moderate.
How do I fix CVE-2022-49845?
To fix CVE-2022-49845, update the Linux Kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux Kernel are affected by CVE-2022-49845?
CVE-2022-49845 affects Linux Kernel versions from 5.4 up to but not including 6.1-rc1.
What type of vulnerability is CVE-2022-49845?
CVE-2022-49845 is a vulnerability related to the initialization of CAN headers in the Linux Kernel.
Is CVE-2022-49845 specific to certain Linux distributions?
CVE-2022-49845 is not specific to any particular Linux distribution but affects the core Linux Kernel.