Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in the CAN J1939 networking code. A local, low-privileged user could trigger a kernel availability problem because a CAN frame header was not fully initialized. The public data rates it medium, with high availability impact and no stated confidentiality or integrity impact.
Executive priority
Treat this as a moderate availability-risk kernel update. It is not presented as remotely exploitable or actively exploited, but it may matter for systems where local users or workloads can affect operational Linux hosts using CAN/J1939 functionality.
Technical view
CVE-2022-49845 fixes missing initialization in j1939_send_one(). The issue involved read access to canxl_frame::len from a J1939-created skbuff, revealing uninitialized reserved or later-filled elements in struct can_frame. The kernel fix zero-initializes the 8-byte CAN header.
Likely exposure
Exposure is most likely on Linux systems running affected kernel builds where the CAN J1939 code is present and reachable by local users or processes. The supplied affected-version data is incomplete and should be reconciled with distribution kernel advisories and the listed stable commits.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, unchanged scope, and high availability impact. The source bundle does not show CISA KEV listing, active exploitation, public exploit availability, or remote attackability.
Researcher notes
Evidence supports an uninitialized-header bug fixed by zeroing the CAN header. The bundle gives commit references and CVSS, but not a full vendor-by-vendor affected matrix, exploit evidence, or operational mitigations beyond applying fixed kernel code.
Mitigation direction
- Check vendor or distribution advisories for CVE-2022-49845 fixed kernel packages.
- Update affected Linux kernels to a vendor-supported build containing the stable fix.
- Prioritize hosts where untrusted local users or workloads can reach CAN/J1939 functionality.
- Use normal kernel rollout controls, including reboot validation after patching.
Validation and detection
- Inventory Linux kernel versions across hosts, appliances, and embedded systems.
- Identify systems using or loading CAN and J1939 kernel functionality.
- Compare source or package changelogs against the referenced stable commits.
- Confirm patched hosts boot the expected fixed kernel version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49845 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d0513b095e1ef1469718564dec3fb3348556d0a8CVE reference, Linux
- https://git.kernel.org/stable/c/f8e0edeaa0f2b860bdbbf0aafb4492533043d650CVE reference, Linux
- https://git.kernel.org/stable/c/69e86c6268d59ceddd0abe9ae8f1f5296f316c3cCVE reference, Linux
- https://git.kernel.org/stable/c/2719f82ad5d8199cf5f346ea8bb3998ad5323b72CVE reference, Linux
- https://git.kernel.org/stable/c/3eb3d283e8579a22b81dd2ac3987b77465b2a22fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.