[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2022-48830":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":23,"technologies":28,"references":30,"score":35,"epss_score":36,"epss_percentile":37,"is_kev":20,"cisa_kev_date_added":38,"cisa_kev_due_date":38,"cisa_ssvc":39,"attack_mappings":49,"exploits":56},318433,"CVE-2022-48830","EUVD-2022-53709","In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\n\nWhen receiving a CAN frame the current code logic does not consider\nconcurrently receiving processes which do not show up in real world\nusage.\n\nZiyang Xuan writes:\n\nThe following syz problem is one of the scenarios. so->rx.len is\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\ntrigger skb_over_panic() in skb_put().\n\n=======================================================\nCPU: 1 PID: 19 Comm: ksoftirqd\u002F1 Not tainted 5.16.0-rc8-syzkaller #0\nRIP: 0010:skb_panic+0x16c\u002F0x16e net\u002Fcore\u002Fskbuff.c:113\nCall Trace:\n \u003CTASK>\n skb_over_panic net\u002Fcore\u002Fskbuff.c:118 [inline]\n skb_put.cold+0x24\u002F0x24 net\u002Fcore\u002Fskbuff.c:1990\n isotp_rcv_cf net\u002Fcan\u002Fisotp.c:570 [inline]\n isotp_rcv+0xa38\u002F0x1e30 net\u002Fcan\u002Fisotp.c:668\n deliver net\u002Fcan\u002Faf_can.c:574 [inline]\n can_rcv_filter+0x445\u002F0x8d0 net\u002Fcan\u002Faf_can.c:635\n can_receive+0x31d\u002F0x580 net\u002Fcan\u002Faf_can.c:665\n can_rcv+0x120\u002F0x1c0 net\u002Fcan\u002Faf_can.c:696\n __netif_receive_skb_one_core+0x114\u002F0x180 net\u002Fcore\u002Fdev.c:5465\n __netif_receive_skb+0x24\u002F0x1b0 net\u002Fcore\u002Fdev.c:5579\n\nTherefore we make sure the state changes and data structures stay\nconsistent at CAN frame reception time by adding a spin_lock in\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\naffect real world operation.","2024-07-16T12:15:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":18,"privilegesRequired":19,"confidentialityImpact":17},"UNCHANGED","3.1",4.7,"LOCAL","MEDIUM","CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H","NONE","HIGH","LOW",false,[22],"CWE-362",[24,25,26,27],"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*",[29],"Linux Linux Kernel",[31,32,33,34],"https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F5b068f33bc8acfcfd5ea7992a2dafb30d89bad30","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F7b53d2204ce79b27a878074a77d64f40ec21dbca","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F7c759040c1dd03954f650f147ae7175476d51314","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Ff90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3",0.24,0.00313,0.23052,null,{"timestamp":40,"automatable":41,"tech_impact":42,"exploitation":43,"cisa_decision":44,"cisa_remediation_timeline":48},"2024-09-10T16:57:30.557476Z","no","partial","none",{"vector":45,"decision":46,"priority":47},"CISAv1\u002FE:N\u002FA:N\u002FT:P\u002FM:H\u002F2026-10-25T08:39:56.484773\u002F","track_star","medium","60D",[50],{"name":51,"source":52,"tactics":53,"technique_id":55},"Exploitation for Privilege Escalation","attack_vector",[54],"privilege-escalation","T1068",[]]