In the Linux kernel, the following vulnerability has been resolved:
can: hi311x: hi3110canist(): fix potential use-after-free
The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off).
The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused.
Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56651.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56651.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc30b2fe8c54694f8ae08a5b8a5d174d16d93075",
"digest": {
"function_hash": "151195867652069833172375071833649295409",
"length": 2442.0
},
"id": "CVE-2024-56651-28641097",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c",
"function": "hi3110_can_ist"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1128022009444faf49359bd406cd665b177cb643",
"digest": {
"function_hash": "151195867652069833172375071833649295409",
"length": 2442.0
},
"id": "CVE-2024-56651-40e38ade",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c",
"function": "hi3110_can_ist"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad86d377ef4a19c75a9c639964879a5b25a433b",
"digest": {
"function_hash": "151195867652069833172375071833649295409",
"length": 2442.0
},
"id": "CVE-2024-56651-515fd444",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c",
"function": "hi3110_can_ist"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad86d377ef4a19c75a9c639964879a5b25a433b",
"digest": {
"line_hashes": [
"190167850527484933226524079235376884017",
"42156265466544472288304326070769645326",
"304962643461544744491324533107322766911",
"257284169053741767346702601249479234650",
"161738916908511288805557486086946482603",
"184785286195249426565704081377632275909",
"104680488663089396475110181891653635914",
"296593503120674553761810256911136779727",
"284484228721536674576254800276445879213"
],
"threshold": 0.9
},
"id": "CVE-2024-56651-7d35979a",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1128022009444faf49359bd406cd665b177cb643",
"digest": {
"line_hashes": [
"190167850527484933226524079235376884017",
"42156265466544472288304326070769645326",
"304962643461544744491324533107322766911",
"257284169053741767346702601249479234650",
"161738916908511288805557486086946482603",
"184785286195249426565704081377632275909",
"104680488663089396475110181891653635914",
"296593503120674553761810256911136779727",
"284484228721536674576254800276445879213"
],
"threshold": 0.9
},
"id": "CVE-2024-56651-93ffe98e",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1",
"digest": {
"line_hashes": [
"190167850527484933226524079235376884017",
"42156265466544472288304326070769645326",
"304962643461544744491324533107322766911",
"257284169053741767346702601249479234650",
"161738916908511288805557486086946482603",
"184785286195249426565704081377632275909",
"104680488663089396475110181891653635914",
"296593503120674553761810256911136779727",
"284484228721536674576254800276445879213"
],
"threshold": 0.9
},
"id": "CVE-2024-56651-ce13ca12",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1",
"digest": {
"function_hash": "151195867652069833172375071833649295409",
"length": 2442.0
},
"id": "CVE-2024-56651-e81e2ce8",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c",
"function": "hi3110_can_ist"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc30b2fe8c54694f8ae08a5b8a5d174d16d93075",
"digest": {
"line_hashes": [
"190167850527484933226524079235376884017",
"42156265466544472288304326070769645326",
"304962643461544744491324533107322766911",
"257284169053741767346702601249479234650",
"161738916908511288805557486086946482603",
"184785286195249426565704081377632275909",
"104680488663089396475110181891653635914",
"296593503120674553761810256911136779727",
"284484228721536674576254800276445879213"
],
"threshold": 0.9
},
"id": "CVE-2024-56651-edbef030",
"deprecated": false,
"target": {
"file": "drivers/net/can/spi/hi311x.c"
}
}
]