Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
In the Linux kernel, the following vulnerability has been resolved:can: hi311x: hi3110_can_ist(): fix potential use-after-freeThe commit a22bd630cfff ("can: hi311x: do not report txerr and rxerrduring bus-off") removed the reporting of rxerr and txerr even in caseof correct operation (i. e. not bus-off).The error count information added to the CAN frame after netif_rx() isa potential use after free, since there is no guarantee that the skbis in the same state. It might be freed or reused.Fix the issue by postponing the netif_rx() call in case of txerr andrxerr reporting.
No PoCs from references.
- https://github.com/cku-heise/euvd-api-doc
- https://github.com/w4zu/Debian_security