Description (CNA)
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| zephyrproject-rtos / Zephyr | affected * before 3.7.2; affected 4.0.0 before 4.2.2; affected 4.3.0 before 4.3.1 |
CWE
CWE-125
References
ADP enrichment
No English description supplied.
No references supplied.