Executive brief
A vulnerability was identified in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) implementation. This component is responsible for managing message filtering and periodic transmission in automotive and industrial networks. An exploit could allow a local user to trigger a system warning or instability by closing a socket under specific conditions, potentially leading to a denial-of-service (system crash or hang).
Technical details
A vulnerability exists in net/can/bcm.c where the 'bo->bcm_proc_read' pointer is not cleared after a call to 'remove_proc_entry()' in the 'bcm_notify()' function. This occurs when a CAN device is unregistered while a BCM socket is bound to it. If the socket is subsequently closed without being reconnected, 'bcm_release()' attempts to remove the same proc entry again, triggering a kernel warning (and potential instability) in 'fs/proc/generic.c'. The fix involves explicitly setting 'bo->bcm_proc_read' to NULL after the first removal to prevent redundant calls. This is a local attack vector requiring no special privileges beyond the ability to create and close CAN sockets.
Affected products
- Linux Linux kernel 4.19.322 and later versions
Timeline
- 2024-09-04: patched: Initial patch authored by Kuniyuki Iwashima
- 2024-10-21: advisory: CVE-2024-47709 published in NVD
References
- https://git.kernel.org/stable/c/5cc00913c1fdcab861c4e65fa20d1f1e1bbbf977
- https://git.kernel.org/stable/c/770b463264426cc3c167b1d44efa85f6a526ce5b
- https://git.kernel.org/stable/c/7a145d6ec2124bdb94bd6fc436b342ff6ddf2b70
- https://git.kernel.org/stable/c/94b0818fa63555a65f6ba107080659ea6bcca63e
- https://git.kernel.org/stable/c/9550baada4c8ef8cebefccc746384842820b4dff
- https://git.kernel.org/stable/c/a833da8eec20b51af39643faa7067b25c8b20f3e
- https://git.kernel.org/stable/c/b02ed2f01240b226570b4a19b5041d61f5125784