CVE-2023-52878: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
In the Linux kernel, the following vulnerability has been resolved:
can: dev: canputechoskb(): don't crash kernel if canpriv::echoskb is accessed out of bounds
If the "struct canpriv::echooskb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
can: dev: canputechoskb(): don't crash kernel if canpriv::echoskb is accessed out of bounds
The Linux kernel CVE team has assigned CVE-2023-52878 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052122-CVE-2023-52878-d433@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an error related canputechoskb(): don't crash kernel if canpriv::echoskb is accessed out of bounds. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52878?
CVE-2023-52878 has been classified with a high severity due to its potential to cause kernel crashes.
How do I fix CVE-2023-52878?
To fix CVE-2023-52878, update the Linux kernel to version 5.15.139, 6.1.63, 6.5.12, 6.6.2, or 6.7.
What systems are affected by CVE-2023-52878?
CVE-2023-52878 affects multiple versions of the Linux kernel in the Red Hat distribution.
What could happen if CVE-2023-52878 is exploited?
If exploited, CVE-2023-52878 may lead to kernel crashes affecting system stability.
Is there a patch available for CVE-2023-52878?
Yes, patches are available in the form of kernel updates for the affected versions.