CVE-2021-47520
published 2024-05-24CVE-2021-47520: In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb)…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
can: pch_can: pch_can_rx_normal: fix use after free
After calling netif_receive_skb(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is dereferenced
just after the call netif_receive_skb(skb).
Reordering the lines solves the issue.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.15-1 (bookworm) | linux 5.15.15-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < bafe343a885c70dddf358379cf0b2a1c07355d8d | bafe343a885c70dddf358379cf0b2a1c07355d8d |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < 3a3c46e2eff0577454860a203be1a8295f4acb76 | 3a3c46e2eff0577454860a203be1a8295f4acb76 |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < affbad02bf80380a7403885b9fe4a1587d1bb4f3 | affbad02bf80380a7403885b9fe4a1587d1bb4f3 |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < 3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa | 3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < abb4eff3dcd2e583060082a18a8dbf31f02689d4 | abb4eff3dcd2e583060082a18a8dbf31f02689d4 |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < 703dde112021c93d6e89443c070e7dbd4dea612e | 703dde112021c93d6e89443c070e7dbd4dea612e |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < 6c73fc931658d8cbc8a1714b326cb31eb71d16a7 | 6c73fc931658d8cbc8a1714b326cb31eb71d16a7 |
| linux | linux | >= b21d18b51b31a24d17f883b678432fbdee3d5675 < 94cddf1e9227a171b27292509d59691819c458db | 94cddf1e9227a171b27292509d59691819c458db |
| linux | linux_kernel | >= 0 < 5.10.92-1 | 5.10.92-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 2.6.37 < 4.4.295 | 4.4.295 |
| linux | linux_kernel | >= 4.10 < 4.14.258 | 4.14.258 |
| linux | linux_kernel | >= 4.15 < 4.19.221 | 4.19.221 |
| linux | linux_kernel | >= 4.20 < 5.4.165 | 5.4.165 |
| linux | linux_kernel | >= 4.5 < 4.9.293 | 4.9.293 |
| linux | linux_kernel | >= 5.11 < 5.15.8 | 5.15.8 |
| linux | linux_kernel | >= 5.5 < 5.10.85 | 5.10.85 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-47520: In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_sk
osv·2024-05-24·CVSS 7.8
CVE-2021-47520 [HIGH] CVE-2021-47520: In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_sk
In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue.
Red Hat
kernel: can: pch_can: pch_can_rx_normal: fix use after free
vendor_redhat·2024-05-24·CVSS 7.8
CVE-2021-47520 [HIGH] CWE-416 kernel: can: pch_can: pch_can_rx_normal: fix use after free
kernel: can: pch_can: pch_can_rx_normal: fix use after free
In the Linux kernel, the following vulnerability has been resolved:
can: pch_can: pch_can_rx_normal: fix use after free
After calling netif_receive_skb(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is dereferenced
just after the call netif_receive_skb(skb).
Reordering the lines solves the issue.
A vulnerability was found in the Linux kernel in the function pch_can_rx_normal() where the improper ordering of function calls can lead to a use-after-free scenario when the function dereferences the skb (socket buffer) object after calling the function netif_receive_skb(), which could have altered or freed skb. This vulnerability could lead to memory corruption or crashes.
Statement: Red Hat
Debian
CVE-2021-47520: linux - In the Linux kernel, the following vulnerability has been resolved: can: pch_ca...
vendor_debian·2021·CVSS 7.8
CVE-2021-47520 [HIGH] CVE-2021-47520: linux - In the Linux kernel, the following vulnerability has been resolved: can: pch_ca...
In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue.
Scope: local
bookworm: resolved (fixed in 5.15.15-1)
bullseye: resolved (fixed in 5.10.92-1)
forky: resolved (fixed in 5.15.15-1)
sid: resolved (fixed in 5.15.15-1)
trixie: resolved (fixed in 5.15.15-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aahttps://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612ehttps://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458dbhttps://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8dhttps://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aahttps://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612ehttps://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458dbhttps://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d
2024-05-24
Published