7.8

CVE-2021-47668

can: dev: can_restart: fix use after free bug

In the Linux kernel, the following vulnerability has been resolved:

can: dev: can_restart: fix use after free bug

After calling netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the netif_rx_ni() in:
      stats->rx_bytes += cf->len;

Reordering the lines solves the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.31 < 4.4.254
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.254
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.218
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.171
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.93
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.11
Linux ≫ Linux Kernel Version5.11 Updaterc1
Linux ≫ Linux Kernel Version5.11 Updaterc2
Linux ≫ Linux Kernel Version5.11 Updaterc3
Linux ≫ Linux Kernel Version5.11 Updaterc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.063
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8
Patch
https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282
Patch
https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421
Patch
https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234
Patch
https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328
Patch
https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a
Patch
https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94
Patch