CVE-2021-47520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47520", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:02:54.824Z", "datePublished": "2024-05-24T15:09:33.796Z", "dateUpdated": "2026-08-05T08:48:14.519Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:14.519Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: pch_can: pch_can_rx_normal: fix use after free\n\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\n\nReordering the lines solves the issue."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The UAF is in the pch_can hardware RX path (PCI interrupt \u2192 NAPI \u2192 pch_can_rx_normal), triggered by Classical CAN frames arriving on the shared CAN bus; like Bluetooth/WiFi this is limited to the same physical bus segment, not Internet-routable.\nAC:L - Any received frame reliably hits the bug: can_receive() always consume_skb()s the original skb after delivery, so cf (aliasing skb data) is always dangling when cf->len is read; the attacker fully controls frame injection on the bus.\nPR:N - Exploitation requires only the ability to inject unauthenticated CAN frames onto the bus attached to the EG20T PCH controller; no local account or capability on the victim Linux system is needed.\nUI:N - No victim action is required beyond the CAN interface already being operational and receiving, which is the normal deployed state for this controller.\nS:U - Impact is confined to the local kernel's networking/stats path; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - This is a use-after-free of skb/can_frame memory after netif_receive_skb; UAF of freed heap objects can be leveraged for information disclosure (including via the cf->len read into observable rx_bytes stats).\nI:H - Use-after-free of the skb backing store enables heap reuse/spray primitives that can be escalated to integrity compromise and control-flow hijacking under standard kernel UAF exploitation models.\nA:H - The deterministic UAF on every RX frame can cause kernel oops/panic (e.g. under KASAN or when the reclaimed page is unmapped), fully disrupting the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/pch_can.c"], "versions": [{"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "bafe343a885c70dddf358379cf0b2a1c07355d8d", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "3a3c46e2eff0577454860a203be1a8295f4acb76", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "affbad02bf80380a7403885b9fe4a1587d1bb4f3", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "abb4eff3dcd2e583060082a18a8dbf31f02689d4", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "703dde112021c93d6e89443c070e7dbd4dea612e", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "6c73fc931658d8cbc8a1714b326cb31eb71d16a7", "status": "affected", "versionType": "git"}, {"version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "94cddf1e9227a171b27292509d59691819c458db", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/pch_can.c"], "versions": [{"version": "2.6.37", "status": "affected"}, {"version": "0", "lessThan": "2.6.37", "status": "unaffected", "versionType": "semver"}, {"version": "4.4.295", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.293", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.258", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.221", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.165", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.85", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.8", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.4.295"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.9.293"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.14.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.19.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.4.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.10.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.15.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d"}, {"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76"}, {"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3"}, {"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa"}, {"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4"}, {"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e"}, {"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7"}, {"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db"}], "title": "can: pch_can: pch_can_rx_normal: fix use after free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T18:03:24.271974Z", "id": "CVE-2021-47520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T18:03:39.525Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.800Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.800Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T18:03:24.271974Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T15:53:46.124Z"}}], "cna": {"title": "can: pch_can: pch_can_rx_normal: fix use after free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The UAF is in the pch_can hardware RX path (PCI interrupt \u2192 NAPI \u2192 pch_can_rx_normal), triggered by Classical CAN frames arriving on the shared CAN bus; like Bluetooth/WiFi this is limited to the same physical bus segment, not Internet-routable.\nAC:L - Any received frame reliably hits the bug: can_receive() always consume_skb()s the original skb after delivery, so cf (aliasing skb data) is always dangling when cf->len is read; the attacker fully controls frame injection on the bus.\nPR:N - Exploitation requires only the ability to inject unauthenticated CAN frames onto the bus attached to the EG20T PCH controller; no local account or capability on the victim Linux system is needed.\nUI:N - No victim action is required beyond the CAN interface already being operational and receiving, which is the normal deployed state for this controller.\nS:U - Impact is confined to the local kernel's networking/stats path; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - This is a use-after-free of skb/can_frame memory after netif_receive_skb; UAF of freed heap objects can be leveraged for information disclosure (including via the cf->len read into observable rx_bytes stats).\nI:H - Use-after-free of the skb backing store enables heap reuse/spray primitives that can be escalated to integrity compromise and control-flow hijacking under standard kernel UAF exploitation models.\nA:H - The deterministic UAF on every RX frame can cause kernel oops/panic (e.g. under KASAN or when the reclaimed page is unmapped), fully disrupting the system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "bafe343a885c70dddf358379cf0b2a1c07355d8d", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "3a3c46e2eff0577454860a203be1a8295f4acb76", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "affbad02bf80380a7403885b9fe4a1587d1bb4f3", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "abb4eff3dcd2e583060082a18a8dbf31f02689d4", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "703dde112021c93d6e89443c070e7dbd4dea612e", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "6c73fc931658d8cbc8a1714b326cb31eb71d16a7", "versionType": "git"}, {"status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "lessThan": "94cddf1e9227a171b27292509d59691819c458db", "versionType": "git"}], "programFiles": ["drivers/net/can/pch_can.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.37"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.37", "versionType": "semver"}, {"status": "unaffected", "version": "4.4.295", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.293", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.258", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.221", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.165", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.85", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.8", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/can/pch_can.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d"}, {"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76"}, {"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3"}, {"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa"}, {"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4"}, {"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e"}, {"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7"}, {"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: pch_can: pch_can_rx_normal: fix use after free\n\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\n\nReordering the lines solves the issue."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.295", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.293", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.258", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.221", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.165", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.85", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.8", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "2.6.37"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:14.519Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47520", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:48:14.519Z", "dateReserved": "2024-05-24T15:02:54.824Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-24T15:09:33.796Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/pch_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bafe343a885c70dddf358379cf0b2a1c07355d8d", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "3a3c46e2eff0577454860a203be1a8295f4acb76", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "affbad02bf80380a7403885b9fe4a1587d1bb4f3", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "abb4eff3dcd2e583060082a18a8dbf31f02689d4", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "703dde112021c93d6e89443c070e7dbd4dea612e", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "6c73fc931658d8cbc8a1714b326cb31eb71d16a7", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}, {"lessThan": "94cddf1e9227a171b27292509d59691819c458db", "status": "affected", "version": "b21d18b51b31a24d17f883b678432fbdee3d5675", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/pch_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.37"}, {"lessThan": "2.6.37", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.295", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.293", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.258", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.221", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.165", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.85", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0BFBC5B8-3555-4F40-8066-0E6481B4B7F2", "versionEndExcluding": "4.4.295", "versionStartIncluding": "2.6.37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D107324-F4B9-4146-BACC-391E95D41D67", "versionEndExcluding": "4.9.293", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71B2A056-7541-4FF3-859E-C55955DDA2DD", "versionEndExcluding": "4.14.258", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CECDDE2F-DEEF-4D3A-85FF-6AEBA16D225B", "versionEndExcluding": "4.19.221", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1DD3148-41FC-42AC-96A5-F63D774A97A3", "versionEndExcluding": "5.4.165", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9668578-08F7-4694-A86F-FCE448387A79", "versionEndExcluding": "5.10.85", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6664ACE2-F748-4AE5-B98B-58803B0B2C3E", "versionEndExcluding": "5.15.8", "versionStartIncluding": "5.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: pch_can: pch_can_rx_normal: fix use after free\n\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\n\nReordering the lines solves the issue."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: pch_can: pch_can_rx_normal: corregir el use after free despu\u00e9s de llamar a netif_receive_skb(skb), desreferenciar skb no es seguro. Especialmente, el can_frame cf que alias la memoria skb se desreferencia justo despu\u00e9s de la llamada netif_receive_skb(skb). Reordenar las l\u00edneas resuelve el problema."}], "id": "CVE-2021-47520", "lastModified": "2026-08-04T10:17:07.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-17T18:03:24.271974Z", "version": "2.0.3"}}]}, "published": "2024-05-24T15:15:14.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: pch_can: pch_can_rx_normal: fix use after free", "id": "2283431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283431"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: pch_can: pch_can_rx_normal: fix use after free\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\nReordering the lines solves the issue."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2021-47520", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47520\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47520\nhttps://lore.kernel.org/linux-cve-announce/2024052433-CVE-2021-47520-af45@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{}