CVE-2022-48830 (GCVE-0-2022-48830)

Vulnerability from cvelistv5 – Published: 2024-07-16 11:44 – Updated: 2026-05-11 18:47
VLAI
Title
can: isotp: fix potential CAN frame reception race in isotp_rcv()
Summary
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix potential CAN frame reception race in isotp_rcv() When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in real world usage. Ziyang Xuan writes: The following syz problem is one of the scenarios. so->rx.len is changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals 0 before alloc_skb() and equals 4096 after alloc_skb(). That will trigger skb_over_panic() in skb_put(). ======================================================= CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Call Trace: <TASK> skb_over_panic net/core/skbuff.c:118 [inline] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [inline] isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579 Therefore we make sure the state changes and data structures stay consistent at CAN frame reception time by adding a spin_lock in isotp_rcv(). This fixes the issue reported by syzkaller but does not affect real world operation.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 7b53d2204ce79b27a878074a77d64f40ec21dbca (git)
Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3 (git)
Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 5b068f33bc8acfcfd5ea7992a2dafb30d89bad30 (git)
Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 7c759040c1dd03954f650f147ae7175476d51314 (git)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.101 , ≤ 5.10.* (semver)
Unaffected: 5.15.24 , ≤ 5.15.* (semver)
Unaffected: 5.16.10 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:57:30.557476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:11.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b53d2204ce79b27a878074a77d64f40ec21dbca",
              "status": "affected",
              "version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
              "versionType": "git"
            },
            {
              "lessThan": "f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3",
              "status": "affected",
              "version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
              "versionType": "git"
            },
            {
              "lessThan": "5b068f33bc8acfcfd5ea7992a2dafb30d89bad30",
              "status": "affected",
              "version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
              "versionType": "git"
            },
            {
              "lessThan": "7c759040c1dd03954f650f147ae7175476d51314",
              "status": "affected",
              "version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.101",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.24",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\n\nWhen receiving a CAN frame the current code logic does not consider\nconcurrently receiving processes which do not show up in real world\nusage.\n\nZiyang Xuan writes:\n\nThe following syz problem is one of the scenarios. so-\u003erx.len is\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so-\u003erx.len equals\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\ntrigger skb_over_panic() in skb_put().\n\n=======================================================\nCPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0\nRIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113\nCall Trace:\n \u003cTASK\u003e\n skb_over_panic net/core/skbuff.c:118 [inline]\n skb_put.cold+0x24/0x24 net/core/skbuff.c:1990\n isotp_rcv_cf net/can/isotp.c:570 [inline]\n isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668\n deliver net/can/af_can.c:574 [inline]\n can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635\n can_receive+0x31d/0x580 net/can/af_can.c:665\n can_rcv+0x120/0x1c0 net/can/af_can.c:696\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465\n __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579\n\nTherefore we make sure the state changes and data structures stay\nconsistent at CAN frame reception time by adding a spin_lock in\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\naffect real world operation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:47:58.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca"
        },
        {
          "url": "https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314"
        }
      ],
      "title": "can: isotp: fix potential CAN frame reception race in isotp_rcv()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48830",
    "datePublished": "2024-07-16T11:44:13.987Z",
    "dateReserved": "2024-07-16T11:38:08.904Z",
    "dateUpdated": "2026-05-11T18:47:58.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48830",
      "date": "2026-05-25",
      "epss": "0.00013",
      "percentile": "0.02116"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\\n\\nWhen receiving a CAN frame the current code logic does not consider\\nconcurrently receiving processes which do not show up in real world\\nusage.\\n\\nZiyang Xuan writes:\\n\\nThe following syz problem is one of the scenarios. so-\u003erx.len is\\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so-\u003erx.len equals\\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\\ntrigger skb_over_panic() in skb_put().\\n\\n=======================================================\\nCPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0\\nRIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113\\nCall Trace:\\n \u003cTASK\u003e\\n skb_over_panic net/core/skbuff.c:118 [inline]\\n skb_put.cold+0x24/0x24 net/core/skbuff.c:1990\\n isotp_rcv_cf net/can/isotp.c:570 [inline]\\n isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668\\n deliver net/can/af_can.c:574 [inline]\\n can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635\\n can_receive+0x31d/0x580 net/can/af_can.c:665\\n can_rcv+0x120/0x1c0 net/can/af_can.c:696\\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465\\n __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579\\n\\nTherefore we make sure the state changes and data structures stay\\nconsistent at CAN frame reception time by adding a spin_lock in\\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\\naffect real world operation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: isotp: corrige una posible ejecuci\\u00f3n de recepci\\u00f3n de tramas CAN en isotp_rcv() Al recibir una trama CAN, la l\\u00f3gica del c\\u00f3digo actual no considera la recepci\\u00f3n simult\\u00e1nea de procesos que no aparecen en el uso en el mundo real. Ziyang Xuan escribe: El siguiente problema syz es uno de los escenarios. so-\u0026gt;rx.len es cambiado por isotp_rcv_ff() durante isotp_rcv_cf(), so-\u0026gt;rx.len es igual a 0 antes de alloc_skb() y es igual a 4096 despu\\u00e9s de alloc_skb(). Eso activar\\u00e1 skb_over_panic() en skb_put(). ==================================================== ===== CPU: 1 PID: 19 Comm: ksoftirqd/1 No contaminado 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Seguimiento de llamadas:  skb_over_panic net/core/skbuff.c:118 [en l\\u00ednea] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [en l\\u00ednea] isotp_rcv+0xa38/0x1e30 net/ can/isotp.c:668 entregar net/can/af_can.c:574 [en l\\u00ednea] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+ 0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579 Por lo tanto, nos aseguramos de que los cambios de estado y las estructuras de datos mantenga la coherencia en el momento de recepci\\u00f3n de la trama CAN agregando un spin_lock en isotp_rcv(). Esto soluciona el problema informado por syzkaller pero no afecta el funcionamiento en el mundo real.\"}]",
      "id": "CVE-2022-48830",
      "lastModified": "2024-11-21T07:34:10.103",
      "published": "2024-07-16T12:15:06.613",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48830\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:06.613\",\"lastModified\":\"2025-09-25T19:22:00.600\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\\n\\nWhen receiving a CAN frame the current code logic does not consider\\nconcurrently receiving processes which do not show up in real world\\nusage.\\n\\nZiyang Xuan writes:\\n\\nThe following syz problem is one of the scenarios. so-\u003erx.len is\\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so-\u003erx.len equals\\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\\ntrigger skb_over_panic() in skb_put().\\n\\n=======================================================\\nCPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0\\nRIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113\\nCall Trace:\\n \u003cTASK\u003e\\n skb_over_panic net/core/skbuff.c:118 [inline]\\n skb_put.cold+0x24/0x24 net/core/skbuff.c:1990\\n isotp_rcv_cf net/can/isotp.c:570 [inline]\\n isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668\\n deliver net/can/af_can.c:574 [inline]\\n can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635\\n can_receive+0x31d/0x580 net/can/af_can.c:665\\n can_rcv+0x120/0x1c0 net/can/af_can.c:696\\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465\\n __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579\\n\\nTherefore we make sure the state changes and data structures stay\\nconsistent at CAN frame reception time by adding a spin_lock in\\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\\naffect real world operation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: isotp: corrige una posible ejecuci\u00f3n de recepci\u00f3n de tramas CAN en isotp_rcv() Al recibir una trama CAN, la l\u00f3gica del c\u00f3digo actual no considera la recepci\u00f3n simult\u00e1nea de procesos que no aparecen en el uso en el mundo real. Ziyang Xuan escribe: El siguiente problema syz es uno de los escenarios. so-\u0026gt;rx.len es cambiado por isotp_rcv_ff() durante isotp_rcv_cf(), so-\u0026gt;rx.len es igual a 0 antes de alloc_skb() y es igual a 4096 despu\u00e9s de alloc_skb(). Eso activar\u00e1 skb_over_panic() en skb_put(). ==================================================== ===== CPU: 1 PID: 19 Comm: ksoftirqd/1 No contaminado 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Seguimiento de llamadas:  skb_over_panic net/core/skbuff.c:118 [en l\u00ednea] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [en l\u00ednea] isotp_rcv+0xa38/0x1e30 net/ can/isotp.c:668 entregar net/can/af_can.c:574 [en l\u00ednea] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+ 0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579 Por lo tanto, nos aseguramos de que los cambios de estado y las estructuras de datos mantenga la coherencia en el momento de recepci\u00f3n de la trama CAN agregando un spin_lock en isotp_rcv(). Esto soluciona el problema informado por syzkaller pero no afecta el funcionamiento en el mundo real.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.10.101\",\"matchCriteriaId\":\"576AFC93-F877-43B1-9500-6CF510FDE4D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.24\",\"matchCriteriaId\":\"866451F0-299E-416C-B0B8-AE6B33E62CCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.10\",\"matchCriteriaId\":\"679523BA-1392-404B-AB85-F5A5408B1ECC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.526Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48830\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:57:30.557476Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.232Z\"}}], \"cna\": {\"title\": \"can: isotp: fix potential CAN frame reception race in isotp_rcv()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e057dd3fc20ffb3d7f150af46542a51b59b90127\", \"lessThan\": \"7b53d2204ce79b27a878074a77d64f40ec21dbca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e057dd3fc20ffb3d7f150af46542a51b59b90127\", \"lessThan\": \"f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e057dd3fc20ffb3d7f150af46542a51b59b90127\", \"lessThan\": \"5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e057dd3fc20ffb3d7f150af46542a51b59b90127\", \"lessThan\": \"7c759040c1dd03954f650f147ae7175476d51314\", \"versionType\": \"git\"}], \"programFiles\": [\"net/can/isotp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/can/isotp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca\"}, {\"url\": \"https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3\"}, {\"url\": \"https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30\"}, {\"url\": \"https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\\n\\nWhen receiving a CAN frame the current code logic does not consider\\nconcurrently receiving processes which do not show up in real world\\nusage.\\n\\nZiyang Xuan writes:\\n\\nThe following syz problem is one of the scenarios. so-\u003erx.len is\\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so-\u003erx.len equals\\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\\ntrigger skb_over_panic() in skb_put().\\n\\n=======================================================\\nCPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0\\nRIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113\\nCall Trace:\\n \u003cTASK\u003e\\n skb_over_panic net/core/skbuff.c:118 [inline]\\n skb_put.cold+0x24/0x24 net/core/skbuff.c:1990\\n isotp_rcv_cf net/can/isotp.c:570 [inline]\\n isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668\\n deliver net/can/af_can.c:574 [inline]\\n can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635\\n can_receive+0x31d/0x580 net/can/af_can.c:665\\n can_rcv+0x120/0x1c0 net/can/af_can.c:696\\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465\\n __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579\\n\\nTherefore we make sure the state changes and data structures stay\\nconsistent at CAN frame reception time by adding a spin_lock in\\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\\naffect real world operation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.101\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.24\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.10\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:24:13.468Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48830\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:24:13.468Z\", \"dateReserved\": \"2024-07-16T11:38:08.904Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:44:13.987Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.