CVE-2022-49008: 
Linux Debian vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2022-49008) was identified in the CAN (Controller Area Network) subsystem, specifically in the can327 driver. The issue involves a potential socket buffer (skb) leak in the can327_feed_frame_to_netdev() function when the network device is down. This vulnerability affects Linux kernel versions from 6.0 up to (excluding) 6.0.12, and various 6.1 release candidates (rc1 through rc7) (NVD).

The vulnerability stems from the can327_feed_frame_to_netdev() function not properly freeing the socket buffer (skb) when the network device is down. Additionally, all callers of can327_feed_frame_to_netdev() failed to free allocated skb, resulting in a memory leak. The issue has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can lead to memory leaks in the kernel when the network device is down, potentially causing system resource exhaustion over time. This could affect system stability and performance, particularly in long-running systems or those frequently transitioning network states (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, and no user interaction is required. However, the impact is limited to availability (memory resources) with no direct impact on confidentiality or integrity (NVD).

The issue has been fixed by adding kfree_skb() in can327_feed_frame_to_netdev() when the network device is down. The fix was implemented in the kernel patch and is available in updated kernel versions. Users should upgrade to Linux kernel version 6.0.12 or later to address this vulnerability (Kernel Patch).