Summary
It was discovered that the 8 Devices USB2CAN interface implementation in
the Linux kernel did not properly handle certain error conditions, leading
to a double-free. A local attacker could possibly use this to cause a
denial of service (system crash).
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux | 4.15.0-188.199 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux | 5.4.0-121.137 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-188.199~16.04.1 |
Vulnerabilities 1
-
Medium 5.5
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
References
-
report
https://ubuntu.com/security/CVE-2022-28388