9.8

CVE-2021-47232

can: j1939: fix Use-after-Free, hold skb ref while in use

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix Use-after-Free, hold skb ref while in use

This patch fixes a Use-after-Free found by the syzbot.

The problem is that a skb is taken from the per-session skb queue,
without incrementing the ref count. This leads to a Use-after-Free if
the skb is taken concurrently from the session queue due to a CTS.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.4 < 5.4.128
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.46
Linux ≫ Linux Kernel Version >= 5.11 < 5.12.13
Linux ≫ Linux Kernel Version 5.13 Update rc1
Linux ≫ Linux Kernel Version 5.13 Update rc2
Linux ≫ Linux Kernel Version 5.13 Update rc3
Linux ≫ Linux Kernel Version 5.13 Update rc4
Linux ≫ Linux Kernel Version 5.13 Update rc5
Linux ≫ Linux Kernel Version 5.13 Update rc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.62% 0.461
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/1071065eeb33d32b7d98c2ce7591881ae7381705
Patch
https://git.kernel.org/stable/c/2030043e616cab40f510299f09b636285e0a3678
Patch
https://git.kernel.org/stable/c/22cba878abf646cd3a02ee7c8c2cef7afe66a256
Patch
https://git.kernel.org/stable/c/509ab6bfdd0c76daebbad0f0af07da712116de22
Patch