CVE-2023-54105 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: check CAN address family in isotp_bind()
Add missing check to block non-AF_CAN binds.
Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field:
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10)
^^^^ This has no funtional impact but the userspace should be notified about the wrong address family field content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability CVE-2023-54105 represents a subtle but significant issue within the Linux kernel's CAN (Controller Area Network) protocol implementation, specifically affecting the ISOTP (ISO 15765-2) transport protocol layer. This flaw resides in the isotp_bind() function which handles socket binding operations for CAN communication. The vulnerability stems from the absence of proper validation for the CAN address family parameter during socket binding operations, creating a potential vector for malformed socket operations that could bypass intended security boundaries.
The technical implementation flaw occurs when the kernel fails to validate that the address family field in the socket address structure explicitly corresponds to AF_CAN (0x1D) before processing the binding operation. The vulnerability was discovered through automated fuzzing conducted by syzbot, which generated test code that correctly sized the sockaddr structure but mistakenly used AF_XDP (0x2C) instead of the appropriate AF_CAN value. This discrepancy demonstrates how seemingly innocuous parameter mismatches can create unexpected execution paths within kernel code, particularly when dealing with protocol-specific socket operations that require strict address family validation.
The operational impact of this vulnerability, while not immediately exploitable for privilege escalation or system compromise, represents a significant concern for kernel security and protocol integrity. The missing validation allows for malformed socket operations that could potentially confuse kernel subsystems or create unexpected behavior in CAN communication stacks. Although the immediate functional impact may be limited, such validation gaps can serve as entry points for more sophisticated attacks or indicate broader issues in kernel protocol handling. This vulnerability aligns with CWE-254, representing a weakness in the kernel's input validation mechanisms for network protocol operations.
The security implications extend beyond simple protocol validation, as this flaw demonstrates how kernel subsystems must maintain strict parameter validation to prevent unexpected behavior that could be leveraged in more complex attack scenarios. The vulnerability highlights the importance of adhering to the principle of least privilege and proper input validation in kernel space operations, particularly for network protocols that handle critical infrastructure communications. This issue connects to ATT&CK technique T1068, which involves exploiting legitimate credentials and privileges, as proper address family validation prevents unauthorized protocol operations that could potentially be used in more sophisticated attacks.
Mitigation strategies for this vulnerability focus on implementing proper address family validation within the kernel's ISOTP binding mechanism. The fix involves adding explicit checks to ensure that only AF_CAN address family values are accepted during isotp_bind() operations, preventing the acceptance of alternative address families such as AF_XDP. System administrators should ensure their kernels are updated with patches addressing this vulnerability, particularly in environments where CAN protocols are actively used for industrial control systems or automotive applications. Additionally, monitoring for unusual socket binding patterns and implementing proper kernel hardening measures can help detect potential exploitation attempts. The fix demonstrates the importance of comprehensive validation in kernel protocols and reinforces the need for thorough testing of edge cases in network protocol implementations.