CVE-2021-47457

can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()

published May 22, 2024

CVSS
—
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()

Using wait_event_interruptible() to wait for complete transmission,

but do not check the result of wait_event_interruptible() which can be

interrupted. It will result in TX buffer has multiple accessors and

the later process interferes with the previous process.

Following is one of the problems reported by syzbot.

=============================================================

WARNING: CPU: 0 PID: 0 at net/can/isotp.c:840 isotp_tx_timer_handler+0x2e0/0x4c0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc7+ #68

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014

RIP: 0010:isotp_tx_timer_handler+0x2e0/0x4c0

Call Trace:

<IRQ>

? isotp_setsockopt+0x390/0x390

__hrtimer_run_queues+0xb8/0x610

hrtimer_run_softirq+0x91/0xd0

? rcu_read_lock_sched_held+0x4d/0x80

__do_softirq+0xe8/0x553

irq_exit_rcu+0xf8/0x100

sysvec_apic_timer_interrupt+0x9e/0xc0

</IRQ>

asm_sysvec_apic_timer_interrupt+0x12/0x20

Add result check for wait_event_interruptible() in isotp_sendmsg()

to avoid multiple accessers for tx buffer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Published
2024-05-22T06:19Z
EPSS history
Timeline
  • 22 MAY 06:19Z
    can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()
    cvelistv5