CVE-2021-34693 Overview
CVE-2021-34693 is an information disclosure vulnerability in the Linux kernel's Controller Area Network Broadcast Manager (net/can/bcm.c). The flaw affects Linux kernel versions through 5.12.10. Parts of a data structure remain uninitialized before being returned to user space, allowing local users to read residual kernel stack memory. The leaked content may contain sensitive kernel data useful for bypassing exploit mitigations such as Kernel Address Space Layout Randomization (KASLR). The issue is tracked under [CWE-909: Missing Initialization of Resource].
Critical Impact
Local users can read uninitialized kernel stack memory through the CAN BCM socket interface, exposing data that aids further kernel exploitation.
Affected Products
- Linux Kernel through 5.12.10
- Debian Linux 9.0
- Debian Linux 10.0
Discovery Timeline
- 2021-06-14 - CVE-2021-34693 published to the National Vulnerability Database (NVD)
- 2021-06-15 - Public disclosure on the Openwall oss-security mailing list
- 2021-07 - Debian Long Term Support advisories released (DSA-4941)
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-34693
Vulnerability Analysis
The vulnerability resides in net/can/bcm.c, which implements the Broadcast Manager (BCM) for the Controller Area Network (CAN) protocol in the Linux kernel. The BCM allows user-space applications to send and receive CAN frames through socket operations. When the kernel populates a data structure in response to a BCM operation, it fails to initialize all member fields before returning the buffer to user space.
Because stack-allocated structures inherit whatever bytes previously occupied that memory region, the uninitialized fields contain stale kernel data. A local user with the ability to open a CAN BCM socket can read these leaked bytes. The exposed data may include kernel pointers, register values, or other sensitive content useful for defeating mitigations such as KASLR.
Root Cause
The root cause is a missing initialization of structure members on a code path that copies kernel-side data to user space. The kernel commit 5e87ddbe resolves the issue by explicitly zero-initializing the affected structure prior to use. This is a classic instance of [CWE-909] where a resource is consumed before being properly initialized.
Attack Vector
Exploitation requires local access and the ability to create a CAN BCM socket (PF_CAN with CAN_BCM protocol). The attacker invokes the affected BCM interface and reads the returned data to harvest uninitialized stack bytes. No user interaction is required, and the operation does not alter kernel state. The vulnerability does not directly grant privilege escalation but is commonly chained with other kernel bugs to bypass address randomization. Technical details are described in the kernel mailing list discussion.
Detection Methods for CVE-2021-34693
Indicators of Compromise
- Unexpected processes opening AF_CAN/PF_CAN sockets on systems that do not legitimately use CAN networking
- Unprivileged user accounts loading the can or can_bcm kernel modules
- Anomalous socket() syscalls with the CAN_BCM protocol parameter from non-automotive or non-industrial workloads
Detection Strategies
- Audit socket(AF_CAN, SOCK_DGRAM, CAN_BCM) calls via auditd or eBPF-based syscall instrumentation
- Monitor kernel module load events for can.ko and can_bcm.ko using modprobe auditing
- Compare running kernel versions against patched baselines to identify hosts still vulnerable to CVE-2021-34693
Monitoring Recommendations
- Enable kernel auditing rules for CAN-related syscalls and module loads on production Linux servers
- Ingest endpoint telemetry into a centralized analytics platform to correlate suspicious local activity with kernel version inventory
- Alert on uncommon use of niche networking protocols by user-space processes that should not require them
How to Mitigate CVE-2021-34693
Immediate Actions Required
- Update the Linux kernel to a version that includes commit 5e87ddbe (later than 5.12.10)
- Apply distribution-provided kernel updates, including Debian advisories DSA-4941 and the Debian LTS announcements from July 14, July 15, and July 16
- Reboot affected hosts after kernel installation to activate the patched image
Patch Information
The upstream fix initializes the affected data structure before it is returned to user space, eliminating the leak of kernel stack memory. Debian shipped fixed packages through DSA-4941 and the corresponding LTS announcements. Other distributions backported the same upstream commit into their supported kernel branches.
Workarounds
- Blacklist the can and can_bcm kernel modules on systems that do not require CAN networking by adding install can_bcm /bin/true to /etc/modprobe.d/
- Restrict the CAP_NET_RAW capability and remove unprivileged access to CAN sockets where feasible
- Apply seccomp filters to block socket() calls using the AF_CAN family for workloads that do not need it
# Disable the vulnerable CAN BCM module on systems that do not require it
echo 'install can /bin/true' | sudo tee /etc/modprobe.d/disable-can.conf
echo 'install can_bcm /bin/true' | sudo tee -a /etc/modprobe.d/disable-can.conf
sudo rmmod can_bcm 2>/dev/null
sudo rmmod can 2>/dev/null
# Verify kernel version is patched
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
