CVE-2022-48977

What it actually does

The vulnerability is a NULL pointer dereference in can_rcv_filter triggered when a netdevice reports ARPHRD_CAN but lacks ml_priv initialization, allowing uninitialized resource access in the CAN receive path.

Why it matters to the business

Linux systems using CAN networking can suffer kernel crashes and denial of service, especially with bonding or tun interfaces; the large number of affected kernel deployments makes patching essential for operational stability.

How an attack unfolds

An attacker sends CAN frames to a system exposing a CAN-claiming netdevice that bypasses the ARPHRD_CAN check due to missing ml_priv, dereferencing the NULL pointer in the receive filter; referenced in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Linux Kernel Use of Uninitialized Resource Vulnerability.

How to fix it

Upgrade the Linux kernel to version 5.4.227 or apply commit 3982652957e8d79ac32efcb725450580650a8644; for miraheze/createwiki update to 693a220f399ee7eb4d00e77c3c667e864b1bd306.

How to confirm the fix worked

Confirm the running kernel reports a fixed version, then exercise CAN receive paths with bonding and tun devices while monitoring for NULL pointer faults.

Typical attack path

1. Create or identify a bonding/tun netdevice that claims ARPHRD_CAN without ml_priv initialization
2. Send crafted CAN frames into the receive path
3. Trigger NULL dereference in can_rcv_filter leading to kernel panic

How to detect it

Search kernel logs and oops reports for references to can_rcv_filter or NULL dereference during CAN frame processing; correlate with presence of bonding or tun CAN devices.

What your security team should do

• Apply the listed kernel updates on all affected systems without delay
• Audit CAN interface usage and disable unnecessary virtual or bonded CAN devices
• Monitor kernel logs for can_rcv_filter related oops entries