| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025122439-CVE-2023-54039-82a4@gregkh> Date: Wed, 24 Dec 2025 11:57:23 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2023-54039: can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access could occur during the memcpy() operation if the size of skb->cb is larger than the size of struct j1939_sk_buff_cb. This is because the memcpy() operation uses the size of skb->cb, leading to a read beyond the struct j1939_sk_buff_cb. Updated the memcpy() operation to use the size of struct j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the memcpy() operation only reads the memory within the bounds of struct j1939_sk_buff_cb, preventing out-of-bounds memory access. Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb is greater than or equal to the size of struct j1939_sk_buff_cb. This ensures that the skb->cb buffer is large enough to hold the j1939_sk_buff_cb structure. [mkl: rephrase commit message] The Linux kernel CVE team has assigned CVE-2023-54039 to this issue. Affected and fixed versions =========================== Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 5.4.241 with commit d2136f05690c272dfc9f9d6efcc51d5f53494b33 Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 5.10.178 with commit 70caa596d158a5d84b117f722d58f3ea503a5ba9 Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 5.15.107 with commit 4fe1d9b6231a68ffc91318f57fd8e4982f028cf7 Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 6.1.24 with commit 4c3fb22a6ec68258ee129a2e6b720f43dffc562f Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 6.2.11 with commit 36befc9aed6202b4a9b906529aea13eacd7e34ff Issue introduced in 5.4 with commit 9d71dd0c70099914fcd063135da3c580865e924c and fixed in 6.3 with commit b45193cb4df556fe6251b285a5ce44046dd36b4a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-54039 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/can/j1939/transport.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d2136f05690c272dfc9f9d6efcc51d5f53494b33 https://git.kernel.org/stable/c/70caa596d158a5d84b117f722d58f3ea503a5ba9 https://git.kernel.org/stable/c/4fe1d9b6231a68ffc91318f57fd8e4982f028cf7 https://git.kernel.org/stable/c/4c3fb22a6ec68258ee129a2e6b720f43dffc562f https://git.kernel.org/stable/c/36befc9aed6202b4a9b906529aea13eacd7e34ff https://git.kernel.org/stable/c/b45193cb4df556fe6251b285a5ce44046dd36b4a
Powered by blists - more mailing lists