CVE-2021-34693

What it actually does

Uninitialized fields in a kernel data structure within net/can/bcm.c allow local processes to read arbitrary kernel stack memory.

Why it matters to the business

Local attackers can obtain sensitive kernel data that may aid privilege escalation or further attacks; the issue affects any system running an unpatched Linux kernel with CAN BCM support and has been public for over five years.

How an attack unfolds

An attacker with local user access creates a CAN BCM socket, supplies a specially crafted message that triggers the uninitialized structure, and reads the leaked kernel stack contents to harvest pointers or other sensitive values.

How to fix it

Upgrade the Linux kernel to a version containing commit 5e87ddbe3942e27e939bdc02deb8579b0cbd8ecc or later; Debian 11/12/13 users should install the ffmpeg packages fixed in 7:4.3.2-0+deb11u2 (or equivalent kernel updates) and reboot.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable range; confirm the bcm module no longer exposes uninitialized memory via code review or memory-leak testing tools.

Typical attack path

1. Gain local shell access on the target system
2. Open a CAN BCM socket and send a malformed message
3. Read the returned kernel stack memory containing sensitive data
4. Use disclosed information to facilitate follow-on attacks

How to detect it

Review authentication and process-creation logs for unexpected local sessions followed by CAN-related activity; inspect kernel audit records for anomalous socket operations on the bcm module.

What your security team should do

• Apply the kernel patch or updated packages immediately on all affected systems
• Restrict local user access and CAN interface usage where possible
• Monitor for new local privilege-escalation attempts that may leverage the disclosed information