CVE-2023-5779 is a medium severity (CVSS 4.4) out-of-bounds write in several Zephyr RTOS CAN drivers, in releases up to 3.5. The remove_rx_filter functions do not check the filter ID. The advisory listed no patched release at review time, but it links fixes for main and four release branches.
What's affected
- Product: Zephyr RTOS, CAN drivers can_stm32, can_nxp_s32 and mcp2515, named in the advisory as examples of the missing bounds check.
- Affected: versions up to and including 3.5.
- Patched versions: the GitHub advisory showed none when checked. It lists fixes as pull requests on main (#64399) and on the v2.7, v3.3, v3.4 and v3.5 branches.
- Severity: 4.4 Medium in the NVD record.
- Impact range from the advisory: from denial of service to arbitrary code execution, if the unchecked inputs are attacker controlled and cross a security boundary.
How to check if you're exposed
Work out whether your firmware builds use Zephyr CAN drivers at all. In a Zephyr project, the CAN subsystem is enabled by a Kconfig option, so search your build configuration:
grep -rn "CONFIG_CAN" build/zephyr/.config
west list zephyr
If CAN is off, you are not exposed through this path. If it is on, check which driver your board uses, and whether your Zephyr checkout contains the commits from the linked pull requests. The advisory lists the fix pull requests for your branch.
What to do now
- Identify products in your portfolio that build Zephyr with CAN support, and record the Zephyr version for each.
- Pull the fix for your release branch from the Zephyr pull requests linked in the advisory, or move to a release that includes it.
- Treat any code path that passes a filter ID from outside the device into remove_rx_filter as untrusted input, and validate the ID in your own application code.
- Rebuild and re-test firmware, then ship it through your normal update channel.
- Subscribe to Zephyr security advisories so backports are not missed.
Why it matters
The weakness is an out-of-bounds write, CWE-787. The drivers take a filter ID and use it as an index into an array without confirming it is in range. Some drivers rely on an assertion, which the advisory notes is sometimes useless, because assertions are often compiled out in release builds.
The score is moderate because reaching the bug needs an application path that lets outside input choose the filter ID. In embedded products that depends entirely on the application. A closed gateway that never exposes the call is low risk, and one that forwards commands from a network is not. This is where reachability analysis helps: knowing whether the vulnerable function can actually be called matters more than the version number. The record does not list this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
The advisory shows no patched version. Am I stuck?
No. The advisory links fixes for main and four release branches. Apply the fix for your branch, or watch for a release that includes it, and confirm in the Zephyr repository.
Sources
Last reviewed: 19 October 2026.
