CVE-2023-52878

What it actually does

Out-of-bounds access to the echo_skb array in can_priv triggers a kernel crash in can_put_echo_skb instead of returning an error after emitting a warning.

Why it matters to the business

Systems running affected Linux kernel versions on Ubuntu LTS releases can experience unexpected kernel crashes when CAN networking code is exercised, leading to denial of service and potential data loss until the system is restarted; the issue affects many long-supported but now end-of-life distributions with no ransomware usage reported.

How an attack unfolds

An attacker with the ability to send crafted CAN frames or control a CAN interface triggers the out-of-bounds array access in the echo buffer handling path, causing an immediate kernel panic rather than graceful failure.

How to fix it

Upgrade to the fixed kernel versions listed for each affected Ubuntu package, for example linux 3.13.0-83.127 on 14.04 LTS, linux 4.4.0-4.19 on 16.04 LTS, linux-aws 4.4.0-1002.2 on 14.04, and equivalent packages for hwe, gke, raspi2 and snapdragon variants.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the listed fixed package versions for the distribution in use and confirm the can_put_echo_skb function contains the added bounds check and warning path.

Typical attack path

1. Obtain local or network access sufficient to interact with a CAN interface
2. Transmit frames or invoke socket operations that cause can_put_echo_skb to index beyond the allocated echo_skb array
3. Trigger kernel panic and system reboot or halt

How to detect it

Review kernel logs for oops or panic entries containing can_put_echo_skb or echo_skb array access violations on systems still running unpatched kernels; correlate with CAN socket activity in audit logs.

What your security team should do

• Prioritize patching all affected Ubuntu 14.04 and 16.04 LTS systems to the exact fixed kernel versions provided
• Disable CAN interfaces or modules where not required until patches are applied
• Monitor for kernel oops or panic logs referencing can_dev or echo_skb after deployment