CVE-2025-39987

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the sun4i_can driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. The driver will consume frame->len as-is with no further checks. This can result in a buffer overflow later on in hi3110_hw_tx() on this line: memcpy(buf + HI3110_FIFO_EXT_DATA_OFF, frame->data, frame->len); Here, frame->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Deferred

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-10-15 08:15:36.783000

Last modified

2026-10-19 21:10:00.160000

View original CVE JSON

{
  "id": "CVE-2025-39987",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-15T08:15:36.783",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: hi311x: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb->len fits the interface's MTU.\n\nUnfortunately, because the sun4i_can driver does not populate its\nnet_device_ops->ndo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n  $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers' xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n  1. the skb->protocol is set to ETH_P_CANXL which is valid (the\n     function does not check the actual device capabilities).\n\n  2. the length is a valid CAN XL length.\n\nAnd so, hi3110_hard_start_xmit() receives a CAN XL frame which it is\nnot able to correctly handle and will thus misinterpret it as a CAN\nframe. The driver will consume frame->len as-is with no further\nchecks.\n\nThis can result in a buffer overflow later on in hi3110_hw_tx() on\nthis line:\n\n\tmemcpy(buf + HI3110_FIFO_EXT_DATA_OFF,\n\t       frame->data, frame->len);\n\nHere, frame->len corresponds to the flags field of the CAN XL frame.\nIn our previous example, we set canxl_frame->flags to 0xff. Because\nthe maximum expected length is 8, a buffer overflow of 247 bytes\noccurs!\n\nPopulate net_device_ops->ndo_change_mtu() to ensure that the\ninterface's MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: hi311x: poblar ndo_change_mtu() para prevenir desbordamiento de búfer\n\nEnviar un PF_PACKET permite eludir la lógica del framework CAN y alcanzar directamente la función xmit() de un controlador CAN. La única comprobación que realiza el framework PF_PACKET es asegurarse de que skb->len se ajusta a la MTU de la interfaz.\n\nDesafortunadamente, debido a que el controlador sun4i_can no puebla su net_device_ops->ndo_change_mtu(), es posible para un atacante configurar una MTU inválida haciendo, por ejemplo:\n\n  $ ip link set can0 mtu 9999\n\nDespués de hacerlo, el atacante podría abrir un socket PF_PACKET usando el protocolo ETH_P_CANXL:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\npara inyectar tramas CAN XL maliciosas. Por ejemplo:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nLa función xmit() de los controladores CAN está llamando a can_dev_dropped_skb() para comprobar que el skb es válido, desafortunadamente bajo las condiciones anteriores, el paquete malicioso es capaz de pasar las comprobaciones de can_dev_dropped_skb():\n\n  1. el skb->protocol está configurado como ETH_P_CANXL, lo cual es válido (la función no comprueba las capacidades reales del dispositivo).\n\n  2. la longitud es una longitud CAN XL válida.\n\nY así, hi3110_hard_start_xmit() recibe una trama CAN XL que no puede manejar correctamente y, por lo tanto, la malinterpretará como una trama CAN. El controlador consumirá frame->len tal cual, sin más comprobaciones.\n\nEsto puede resultar en un desbordamiento de búfer más adelante en hi3110_hw_tx() en esta línea:\n\n\tmemcpy(buf + HI3110_FIFO_EXT_DATA_OFF,\n\t       frame->data, frame->len);\n\nAquí, frame->len corresponde al campo flags de la trama CAN XL. En nuestro ejemplo anterior, configuramos canxl_frame->flags a 0xff. Debido a que la longitud máxima esperada es 8, ¡ocurre un desbordamiento de búfer de 247 bytes!\n\nPoblar net_device_ops->ndo_change_mtu() para asegurar que la MTU de la interfaz no pueda ser configurada a nada mayor que CAN_MTU. Al corregir la causa raíz, esto previene el desbordamiento de búfer."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "f2c247e9581024d8b3dd44cbe086bf2bebbef42c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "8f351db6b2367991f0736b2cff082f5de4872113",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "7ab85762274c0fa997f0ef9a2307b2001aae43c4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "57d332ce8c921d0e340650470bb0c1d707f216ee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "be1b25005fd0f9d4e78bec6695711ef87ee33398",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "def814b4ba31b563584061d6895d5ff447d5bc14",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "e77fdf9e33a83a08f04ab0cb68c19ddb365a622f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "57e83fb9b7468c75cb65cde1d23043553c346c6d",
              "lessThan": "ac1c7656fa717f29fac3ea073af63f0b9919ec9a",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.4.300",
              "lessThanOrEqual": "5.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.245",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.194",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.155",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.109",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.50",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.10",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/57d332ce8c921d0e340650470bb0c1d707f216ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7ab85762274c0fa997f0ef9a2307b2001aae43c4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f351db6b2367991f0736b2cff082f5de4872113",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ac1c7656fa717f29fac3ea073af63f0b9919ec9a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/be1b25005fd0f9d4e78bec6695711ef87ee33398",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/def814b4ba31b563584061d6895d5ff447d5bc14",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e77fdf9e33a83a08f04ab0cb68c19ddb365a622f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f2c247e9581024d8b3dd44cbe086bf2bebbef42c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}