linux-kernel - [PATCH 0/4] can: populate ndo_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250918-can-fix-mtu-v1-0-0d1cada9393b@kernel.org>
Date: Thu, 18 Sep 2025 18:00:23 +0900
From: Vincent Mailhol <mailhol@...nel.org>
To: Marc Kleine-Budde <mkl@...gutronix.de>, 
 Oliver Hartkopp <socketcan@...tkopp.net>
Cc: Arunachalam Santhanam <arunachalam.santhanam@...bosch.com>, 
 Akshay Bhat <akshay.bhat@...esys.com>, 
 Wolfgang Grandegger <wg@...ndegger.com>, Chen-Yu Tsai <wens@...e.org>, 
 Jernej Skrabec <jernej.skrabec@...il.com>, 
 Samuel Holland <samuel@...lland.org>, Maxime Ripard <mripard@...nel.org>, 
 Gerhard Bertelsmann <info@...hard-bertelsmann.de>, 
 Yasushi SHOJI <yashi@...cecubics.com>, 
 Remigiusz Kołłątaj <remigiusz.kollataj@...ica.com>, 
 linux-can@...r.kernel.org, linux-kernel@...r.kernel.org, 
 linux-arm-kernel@...ts.infradead.org, linux-sunxi@...ts.linux.dev, 
 Vincent Mailhol <mailhol@...nel.org>
Subject: [PATCH 0/4] can: populate ndo_change_mtu() to prevent buffer
 overflow

Four drivers, namely etas_es58x, hi311x, sun4i_can and mcba_usb forgot
to populate their net_device_ops->ndo_change_mtu(). Because of that,
the user is free to configure any MTU on these interfaces.

This can be abused by an attacker who could craft some skbs and send
them through PF_PACKET to perform a buffer overflow of up to 247 bytes
in each of these drivers.

This series contains four patches, one for each of the drivers, to add
the missing ndo_change_mtu() callback. The descriptions contain
detailed explanations of how the buffer overflow could be triggered.

Signed-off-by: Vincent Mailhol <mailhol@...nel.org>
---
Vincent Mailhol (4):
      can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
      can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
      can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
      can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow

 drivers/net/can/spi/hi311x.c                | 1 +
 drivers/net/can/sun4i_can.c                 | 1 +
 drivers/net/can/usb/etas_es58x/es58x_core.c | 3 ++-
 drivers/net/can/usb/mcba_usb.c              | 1 +
 4 files changed, 5 insertions(+), 1 deletion(-)
---
base-commit: f83ec76bf285bea5727f478a68b894f5543ca76e
change-id: 20250918-can-fix-mtu-b521e1ed1a29

Best regards,
-- 
Vincent Mailhol <mailhol@...nel.org>