CVE-2022-49008 is a vulnerability identified in the Linux kernel specifically within the CAN (Controller Area Network) subsystem, in the function can327_feed_frame_to_netdev(). The issue arises when the network device (netdev) is down: the function fails to free the socket buffer (skb) that it allocated, resulting in a memory leak. The callers of this function also do not free the skb in this scenario, compounding the problem. The vulnerability is due to missing calls to kfree_skb() to release the allocated memory when the netdev is down. This can lead to a gradual depletion of kernel memory resources, potentially causing system instability or denial of service (DoS) conditions. The fix involves adding a call to kfree_skb() in the function to ensure proper cleanup of the skb when the netdev is down. The patch was compiled but not tested at the time of disclosure. The vulnerability affects Linux kernel versions identified by the commit hash 43da2f07622f41376c7ddab8f73dc2b1d3ab9715. There are no known exploits in the wild currently, and no CVSS score has been assigned yet.

For European organizations relying on Linux-based systems, especially those utilizing CAN interfaces (common in automotive, industrial control systems, and embedded devices), this vulnerability could lead to memory leaks in the kernel. Over time, this can degrade system performance, cause kernel crashes, or trigger denial of service, impacting availability of critical systems. Industrial environments using Linux for automation or vehicle control systems could face operational disruptions. While the vulnerability does not directly allow code execution or privilege escalation, the resulting instability could be exploited as part of a broader attack chain or cause significant downtime. Organizations with embedded Linux devices or IoT infrastructure using CAN protocols should be particularly vigilant. The absence of known exploits reduces immediate risk, but the potential for resource exhaustion attacks remains a concern.

Organizations should promptly apply the patch that fixes the skb leak by ensuring the Linux kernel is updated to a version including the fix for CVE-2022-49008. For embedded or specialized systems where kernel updates are challenging, consider implementing monitoring for kernel memory usage and CAN interface status to detect abnormal resource consumption early. Employ kernel hardening techniques and limit access to CAN interfaces to trusted processes only. Additionally, conduct thorough testing of kernel updates in controlled environments before deployment to avoid regressions, given the patch was initially untested. Network segmentation and strict access controls around devices using CAN can reduce exposure. Finally, maintain an inventory of Linux systems using CAN to prioritize patching and monitoring efforts.