CVE-2023-2166: Linux Kernel CAN Protocol DOS Vulnerability

CVE-2023-2166 Overview

CVE-2023-2166 is a null pointer dereference vulnerability in the Linux kernel's Controller Area Network (CAN) protocol implementation. The flaw resides in net/can/af_can.c, where the ml_priv field may remain uninitialized in the receive path of CAN frames. A local authenticated user can trigger the dereference to crash the kernel and cause a denial of service. The issue is tracked under [CWE-476: NULL Pointer Dereference] and affects Linux kernel 6.1 release candidates and the 6.1 release line.

Critical Impact
Local users can crash the system by triggering an uninitialized ml_priv access in the CAN receive path, resulting in kernel-level denial of service.

Affected Products

Linux Kernel 6.1 (release)
Linux Kernel 6.1 release candidates (rc1 through rc8)
Systems with CAN protocol support enabled in net/can/af_can.c

Discovery Timeline

2023-04-19 - CVE-2023-2166 published to the National Vulnerability Database
2025-02-05 - Last updated in the NVD database

Technical Details for CVE-2023-2166

Vulnerability Analysis

The vulnerability exists in the Linux kernel's CAN protocol layer, specifically within net/can/af_can.c. The ml_priv member of the network device structure is expected to point to per-device CAN private data used during frame reception. Under certain conditions, the receive path does not verify that ml_priv has been initialized before dereferencing it. When an unprivileged local user transmits or receives CAN frames on a device where ml_priv is not set, the kernel attempts to access a null pointer.

The result is a kernel oops, which terminates the offending process and may render the system unstable or unresponsive. The impact is limited to availability, as the flaw does not enable code execution, privilege escalation, or information disclosure. Exploitation requires local access and the ability to interact with the CAN subsystem, but no special privileges beyond standard user capabilities for socket operations.

Root Cause

The root cause is a missing initialization check for the ml_priv pointer in the CAN frame receive handler. The CAN subsystem assumes ml_priv is populated for all network devices participating in CAN traffic. When this assumption fails, the receive path dereferences a null pointer and triggers a fatal kernel exception.

Attack Vector

Exploitation requires local access to the target system. An attacker with the ability to open a CAN socket and inject or receive frames on a device lacking a valid ml_priv allocation can trigger the null pointer dereference. The condition can be reached through standard socket APIs without elevated privileges, making any local user capable of causing the crash on a vulnerable system that exposes CAN interfaces. See the Linux Kernel Mailing List Post for the upstream discussion and fix details.

Detection Methods for CVE-2023-2166

Indicators of Compromise

Kernel oops or panic messages in dmesg referencing af_can.c or null pointer dereference in the CAN receive path
Unexpected system crashes correlated with local user activity involving AF_CAN sockets
Repeated process terminations from users invoking socket(AF_CAN, ...) followed by frame transmission

Detection Strategies

Audit kernel logs for BUG: unable to handle kernel NULL pointer dereference entries with stack traces involving CAN protocol functions
Monitor auditd records for unusual socket creation events using the AF_CAN address family by non-system users
Track kernel version inventory across Linux hosts to identify systems running affected 6.1 release-candidate or release builds

Monitoring Recommendations

Enable persistent kernel crash collection through kdump to capture and analyze oops events tied to CAN frame processing
Forward /var/log/kern.log and journald kernel messages to a centralized logging platform for correlation across hosts
Alert on repeated kernel oops events on the same host within short time windows, which may indicate active exploitation attempts

How to Mitigate CVE-2023-2166

Immediate Actions Required

Upgrade the Linux kernel to a fixed stable release that includes the ml_priv initialization fix from upstream
Restrict access to CAN interfaces to trusted users only, using standard Linux capability and namespace controls
Audit installed kernel versions across the fleet and prioritize patching hosts running 6.1 release candidates or the initial 6.1 release

Patch Information

The upstream fix adds the required initialization and null check in the CAN receive path. Distribution vendors have backported the patch to their supported kernel branches. Refer to the Linux Kernel Mailing List Post for the upstream patch reference and apply the corresponding stable update from your distribution's security advisories.

Workarounds

Unload the CAN kernel modules (can, can_raw, can_bcm) on systems that do not require CAN bus functionality using modprobe -r
Blacklist CAN modules in /etc/modprobe.d/ to prevent automatic loading on systems where the protocol is not used
Restrict the CAP_NET_RAW capability and limit which users can create AF_CAN sockets through Linux Security Modules such as SELinux or AppArmor

bash

# Disable CAN modules on systems that do not require CAN bus support
echo 'blacklist can' | sudo tee /etc/modprobe.d/disable-can.conf
echo 'blacklist can_raw' | sudo tee -a /etc/modprobe.d/disable-can.conf
echo 'blacklist can_bcm' | sudo tee -a /etc/modprobe.d/disable-can.conf
sudo modprobe -r can_bcm can_raw can

# Verify current kernel version against fixed releases
uname -r