Linux Kernel CAN BCM Locking Vulnerability in Runtime Updates

A vulnerability in the Linux kernel's CAN broadcast manager (CAN BCM) has been addressed. The issue arose because CAN BCM can send a sequence of CAN frames via hrtimer, with the content and length of the sequence adjustable at runtime. This dynamic modification, although initially thought to be safe, allowed user space to trigger updates to the 'currframe' counter, resetting it to zero. Exploitation could lead to a KASAN slab-out-of-bounds read access. The vulnerability has been mitigated by adding a spin lock to protect the 'count' variable, which can be altered from both user space and hrtimer context.

Impact

Exploitation of this vulnerability could lead to a KASAN slab-out-of-bounds read access.