Executive brief
A security vulnerability has been identified in the Linux kernel's HI-311x CAN driver, which is used for Controller Area Network (CAN) communication in various industrial and automotive systems. An attacker with local access could bypass standard network checks to send specially crafted data packets that exceed the system's memory limits. This could lead to a system crash or allow the attacker to gain unauthorized control over the operating system.
Technical details
A buffer overflow vulnerability exists in the hi311x CAN driver (drivers/net/can/spi/hi311x.c) because it fails to implement the ndo_change_mtu function. This omission allows a local user to set an arbitrarily large Maximum Transmission Unit (MTU) on the CAN interface. By opening a PF_PACKET socket with the ETH_P_CANXL protocol, an attacker can bypass the CAN framework's standard validation and reach the driver's xmit function directly. The driver subsequently misinterprets CAN XL frame flags as a length field during a memcpy operation in hi3110_hw_tx(), leading to a heap-based buffer overflow of up to 247 bytes. The issue has been resolved by populating ndo_change_mtu with can_change_mtu to enforce CAN_MTU limits.
Affected products
- Linux Linux Kernel 4.12 to 6.15.y
Timeline
- 2025-09-18: patched: Initial patch authored
- 2025-10-02: patched: Patch committed to stable branches
- 2025-10-15: disclosed: CVE published
References
- https://git.kernel.org/stable/c/57d332ce8c921d0e340650470bb0c1d707f216ee
- https://git.kernel.org/stable/c/7ab85762274c0fa997f0ef9a2307b2001aae43c4
- https://git.kernel.org/stable/c/8f351db6b2367991f0736b2cff082f5de4872113
- https://git.kernel.org/stable/c/ac1c7656fa717f29fac3ea073af63f0b9919ec9a
- https://git.kernel.org/stable/c/be1b25005fd0f9d4e78bec6695711ef87ee33398
- https://git.kernel.org/stable/c/def814b4ba31b563584061d6895d5ff447d5bc14
- https://git.kernel.org/stable/c/e77fdf9e33a83a08f04ab0cb68c19ddb365a622f