CVE-2021-47668: can: dev: can_restart: fix use after free bug
In the Linux kernel, the following vulnerability has been resolved:
can: dev: canrestart: fix use after free bug
After calling netifrxni(skb), dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the netifrxni() in: stats->rxbytes += cf->len;
Reordering the lines solves the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reorder the lines in can: dev: can_restart: fix use after free bug so that after calling netif_rx_ni(skb), you do not access cf->len (where cf aliases skb memory). Concretely, ensure 'stats->rx_bytes += cf->len;' executes before the 'netif_rx_ni()' call.
Linux kernel (can: dev: can_restart) Reorder statement after netif_rx_ni() = Move stats->rx_bytes += cf->len to occur before the netif_rx_ni() call so cf (aliasing skb memory) is not accessed after netif_rx_ni(skb)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47668?
CVE-2021-47668 has been classified with a moderate severity level due to the potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2021-47668?
To fix CVE-2021-47668, you should update to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2021-47668?
CVE-2021-47668 affects multiple versions of the Linux kernel prior to the application of the relevant patches.
What is a use-after-free bug in the context of CVE-2021-47668?
In CVE-2021-47668, a use-after-free bug occurs when the memory of a data structure is accessed after it has been freed, potentially leading to memory corruption.
Can CVE-2021-47668 be exploited remotely?
Yes, an attacker with appropriate privileges could potentially exploit CVE-2021-47668, but remote exploitation is contingent on specific conditions being met.