CVE-2023-54105

What it actually does

Missing address family validation in isotp_bind() permits non-AF_CAN sockaddr structures (e.g., AF_XDP) of matching size to be bound without error or functional effect.

Why it matters to the business

No operational disruption or data exposure occurs; the sole consequence is that userspace receives no notification of an incorrect address family field.

How an attack unfolds

An automated fuzzer constructs a bind call using a sockaddr_isotp-sized structure but populates the family field with AF_XDP instead of AF_CAN; the kernel accepts the bind because the check is absent, though no subsequent CAN or isotp operations are affected.

How to fix it

Upgrade to a kernel containing commit 19a8520895484e68fd254773e32476565d91deea (or equivalent backport) that adds the AF_CAN family check in isotp_bind().

How to confirm the fix worked

Confirm the patched isotp_bind() contains an explicit comparison of the sockaddr family field against AF_CAN before proceeding; re-run the original syzbot reproducer to verify it now returns an error.

Typical attack path

1. Craft a sockaddr structure of size 0x10 with family set to 0x2C (AF_XDP)
2. Call bind() on an isotp socket using the malformed address
3. Kernel skips AF_CAN verification and returns success

How to detect it

Review kernel audit logs or strace output for bind() calls on isotp sockets that specify a non-AF_CAN address family; no persistent artifacts are created.

What your security team should do

• Apply the referenced kernel commit or distribution update at the next maintenance window
• Monitor for any future syzbot or fuzzing reports targeting isotp or can subsystems