CWE Code: 787
Vulnerability Type: privilege_escalation
CVSS Score: 4.9
CWE Name:  Out-of-bounds Write
Summary: an issue was discovered in can_can_gw_rcv in net/can/gw.c in the linux kernel through 4.19.13. the can frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. the privileged user "root" with cap_net_admin can create a can frame modification rule that makes the data length code a higher value than the available can frame data size. in combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. because of a missing check, the can drivers may write arbitrary content beyond the data registers in the can controller's i/o memory when processing can-gw manipulated outgoing frames.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): NONE/NONE/COMPLETE
Published Date: 2019-01-03
Last Modified Date: 2019-09-03
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Out-of-bounds Write.
user
CWE Code: 787
Vulnerability Type: privilege_escalation
CVSS Score: 4.9
CWE Name:  Out-of-bounds Write
Summary: an issue was discovered in can_can_gw_rcv in net/can/gw.c in the linux kernel through 4.19.13. the can frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. the privileged user "root" with cap_net_admin can create a can frame modification rule that makes the data length code a higher value than the available can frame data size. in combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. because of a missing check, the can drivers may write arbitrary content beyond the data registers in the can controller's i/o memory when processing can-gw manipulated outgoing frames.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): NONE/NONE/COMPLETE
Published Date: 2019-01-03
Last Modified Date: 2019-09-03
assistant