can: hi311x: hi3110_can_ist(): fix potential use-after-free
The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr
during bus-off") removed the reporting of rxerr and txerr even in case
of correct operation (i. e. not bus-off).
The error count information added to the CAN frame after netif_rx() is
a potential use after free, since there is no guarantee that the skb
is in the same state. It might be freed or reused.
Fix the issue by postponing the netif_rx() call in case of txerr and
rxerr reporting.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4076-1 | linux-6.1 security update |
EUVD |
EUVD-2024-53299 | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting. |
Ubuntu USN |
USN-7379-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7379-2 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7380-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7381-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7382-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-7449-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7449-2 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7450-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7451-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7452-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7453-1 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7455-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7455-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7455-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7455-4 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-7455-5 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7459-1 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-7459-2 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-7460-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7461-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7461-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7461-3 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7462-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7462-2 | Linux kernel (AWS FIPS) vulnerabilities |
Ubuntu USN |
USN-7463-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7468-1 | Linux kernel (Azure, N-Series) vulnerabilities |
Ubuntu USN |
USN-7475-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7496-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7496-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7496-3 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7496-4 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7496-5 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7523-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
Ubuntu USN |
USN-7524-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7539-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7540-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 11 Feb 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 06 Jan 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-416 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Sat, 28 Dec 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Fri, 27 Dec 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting. | |
| Title | can: hi311x: hi3110_can_ist(): fix potential use-after-free | |
| References |
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-11-03T20:51:58.194Z
Reserved: 2024-12-27T15:00:39.841Z
Link: CVE-2024-56651
Updated: 2025-02-11T15:41:44.247Z
Status : Modified
Published: 2024-12-27T15:15:24.917
Modified: 2025-11-03T21:18:14.820
Link: CVE-2024-56651
OpenCVE Enrichment
No data.
Debian DLA
EUVD
Ubuntu USN