CVE-2019-3701
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-3701
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3701.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-3701
- Related
- Published
- 2019-01-03T16:29:00Z
- Modified
- 2024-06-30T12:01:22Z
- Severity
-
- 4.4 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in cancangwrcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the candlc field. The privileged user "root" with CAPNETADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgwcsumxorrel) the tail of the skb (e.g. fraglist pointer in skbsharedinfo) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.
- References
-
- http://www.securityfocus.com/bid/106443
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=0aaa81377c5a01f686bcdb8c7a6929a7bf330c68
- https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
- https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
- https://marc.info/?l=linux-netdev&m=154661373531512&w=2
- https://bugzilla.suse.com/show_bug.cgi?id=1120386
- https://marc.info/?l=linux-netdev&m=154651842302479&w=2
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
- https://support.f5.com/csp/article/K17957133
- https://usn.ubuntu.com/3932-1/
- https://usn.ubuntu.com/3932-2/
- https://usn.ubuntu.com/4115-1/
- https://usn.ubuntu.com/4118-1/
- https://security-tracker.debian.org/tracker/CVE-2019-3701
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source