linux: In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can...
CVE-2022-48977 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48977, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.
In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") we need to check for a missing initialization of ml_priv in the receive path of CAN frames. Since commit 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") the check for dev->type to be ARPHRD_CAN is not sufficient anymore since bonding or tun netdevices claim to be CAN devices but do not initialize ml_priv accordingly.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| linux · Debian 12.15 (bookworm) | 6.1.4-1 | DEBIAN-CVE-2022-48977 | Oct 21, 2024 |
| linux · Debian 13.5 (trixie) | 6.1.4-1 | DEBIAN-CVE-2022-48977 | Oct 21, 2024 |
| linux · Debian 14 | 6.1.4-1 | DEBIAN-CVE-2022-48977 | Oct 21, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.