High · published December 27, 2024
In the Linux kernel, the following vulnerability has been resolved:
can: hi311x: hi3110_can_ist(): fix potential use-after-free
The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr
during bus-off") removed the reporting of rxerr and txerr even in case
of correct operation (i. e. not bus-off).
The error count information added to the CAN frame after netif_rx() is
a potential use after free, since there is no guarantee that the skb
is in the same state. It might be freed or reused.
Fix the issue by postponing the netif_rx() call in case of txerr and
rxerr reporting.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.14.291, < 4.15 | 4.15 |
| linux/linux_kernel | ≥ 4.19.256, < 4.20 | 4.20 |
| linux/linux_kernel | ≥ 5.4.211, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.10.137, < 5.11 | 5.11 |
| linux/linux_kernel | ≥ 5.15.61, < 5.16 | 5.16 |
| linux/linux_kernel | ≥ 5.18.18, < 5.19 | 5.19 |
| linux/linux_kernel | ≥ 5.19.2, < 5.20 | 5.20 |
| linux/linux_kernel | ≥ 6.0, < 6.1.120 | 6.1.120 |
| linux/linux_kernel | ≥ 6.2, < 6.6.66 | 6.6.66 |
| linux/linux_kernel | ≥ 6.7, < 6.12.5 | 6.12.5 |
| linux/linux_kernel | all versions | — |