CVE-2020-11494

What it actually does

The flaw in slc_bump allows an attacker to read uninitialized can_frame structures from kernel stack memory when CONFIG_INIT_STACK_ALL is disabled, exposing arbitrary kernel memory contents.

Why it matters to the business

Organizations running affected Linux kernels on systems using SLCAN CAN interfaces face risk of sensitive kernel data leakage to local privileged users, potentially aiding further attacks or exposing credentials and keys.

How an attack unfolds

A local attacker with root privileges configures an SLCAN interface and triggers slc_bump to cause the kernel to copy uninitialized stack data into a user-accessible buffer, allowing extraction of sensitive information.

How to fix it

Upgrade the Linux kernel to a version containing commit b9258a2cece4ec1f020715fe3554bc2e360f6264 or later; rebuild and reboot with the patched kernel; alternatively enable CONFIG_INIT_STACK_ALL at compile time.

How to confirm the fix worked

Verify the running kernel contains commit b9258a2cece4ec1f020715fe3554bc2e360f6264 or is newer than 5.6.2; inspect kernel build configuration for CONFIG_INIT_STACK_ALL; test by exercising SLCAN interfaces and confirming no uninitialized data is returned.

Typical attack path

1. Obtain local root access on a vulnerable Linux system
2. Load or configure the slcan driver and create an SLCAN network interface
3. Invoke slc_bump through crafted CAN operations
4. Read the returned can_frame data to harvest uninitialized kernel stack contents

How to detect it

Review kernel logs and audit records for unusual SLCAN interface creation or CAN frame handling by privileged processes; examine memory dumps or core files for patterns consistent with can_frame leakage from stack regions.

What your security team should do

• Prioritize kernel upgrades on all systems exposing SLCAN or CAN interfaces
• Audit systems for use of the slcan driver and restrict local root access where possible
• Monitor for new kernel releases and apply patches within standard maintenance windows