High · published May 24, 2024
In the Linux kernel, the following vulnerability has been resolved:
can: pch_can: pch_can_rx_normal: fix use after free
After calling netif_receive_skb(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is dereferenced
just after the call netif_receive_skb(skb).
Reordering the lines solves the issue.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.37, < 4.4.295 | 4.4.295 |
| linux/linux_kernel | ≥ 4.5, < 4.9.293 | 4.9.293 |
| linux/linux_kernel | ≥ 4.10, < 4.14.258 | 4.14.258 |
| linux/linux_kernel | ≥ 4.15, < 4.19.221 | 4.19.221 |
| linux/linux_kernel | ≥ 4.20, < 5.4.165 | 5.4.165 |
| linux/linux_kernel | ≥ 5.5, < 5.10.85 | 5.10.85 |
| linux/linux_kernel | ≥ 5.11, < 5.15.8 | 5.15.8 |