can: hi311x: hi3110_can_ist(): fix potential use-after-free
The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr
during bus-off") removed the reporting of rxerr and txerr even in case
of correct operation (i. e. not bus-off).
The error count information added to the CAN frame after netif_rx() is
a potential use after free, since there is no guarantee that the skb
is in the same state. It might be freed or reused.
Fix the issue by postponing the netif_rx() call in case of txerr and
rxerr reporting.
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4076-1 | linux-6.1 security update |
EUVD |
EUVD-2024-53299 | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting. |
Ubuntu USN |
USN-7379-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7379-2 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7380-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7381-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7382-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-7449-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7449-2 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7450-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7451-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7452-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7453-1 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7455-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7455-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7455-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7455-4 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-7455-5 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7459-1 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-7459-2 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-7460-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7461-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7461-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7461-3 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7462-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7462-2 | Linux kernel (AWS FIPS) vulnerabilities |
Ubuntu USN |
USN-7463-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7468-1 | Linux kernel (Azure, N-Series) vulnerabilities |
Ubuntu USN |
USN-7475-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7496-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7496-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7496-3 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7496-4 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7496-5 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7523-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
Ubuntu USN |
USN-7524-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7539-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7540-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 11 Feb 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 06 Jan 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-416 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Sat, 28 Dec 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Fri, 27 Dec 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting. | |
| Title | can: hi311x: hi3110_can_ist(): fix potential use-after-free | |
| References |
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T20:56:36.640Z
Reserved: 2024-12-27T15:00:39.841Z
Link: CVE-2024-56651
Updated: 2025-02-11T15:41:44.247Z
Status : Modified
Published: 2024-12-27T15:15:24.917
Modified: 2025-11-03T21:18:14.820
Link: CVE-2024-56651
OpenCVE Enrichment
No data.
Debian DLA
EUVD
Ubuntu USN