linux-cve-announce - CVE-2023-54105: can: isotp: check CAN address family in isotp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122411-CVE-2023-54105-fbe5@gregkh>
Date: Wed, 24 Dec 2025 14:07:02 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54105: can: isotp: check CAN address family in isotp_bind()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: check CAN address family in isotp_bind()

Add missing check to block non-AF_CAN binds.

Syzbot created some code which matched the right sockaddr struct size
but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family
field:

bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10)
                                ^^^^
This has no funtional impact but the userspace should be notified about
the wrong address family field content.

The Linux kernel CVE team has assigned CVE-2023-54105 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.200 with commit de3c02383aa678f6799402ac47fdd89cf4bfcaa9
	Fixed in 5.15.138 with commit 2fc6f337257f4f7c21ecff429241f7acaa6df4e8
	Fixed in 6.1.16 with commit 9427584c2f153d0677ef3bad6f44028c60d728c4
	Fixed in 6.2.3 with commit dd4faace51e41a82a8c0770ee0cc26088f9d9d06
	Fixed in 6.3 with commit c6adf659a8ba85913e16a571d5a9bcd17d3d1234

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54105
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/isotp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/de3c02383aa678f6799402ac47fdd89cf4bfcaa9
	https://git.kernel.org/stable/c/2fc6f337257f4f7c21ecff429241f7acaa6df4e8
	https://git.kernel.org/stable/c/9427584c2f153d0677ef3bad6f44028c60d728c4
	https://git.kernel.org/stable/c/dd4faace51e41a82a8c0770ee0cc26088f9d9d06
	https://git.kernel.org/stable/c/c6adf659a8ba85913e16a571d5a9bcd17d3d1234