356 lines
17 KiB
JSON
356 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2021-47520",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-05-24T15:02:54.824Z",
|
|
"datePublished": "2024-05-24T15:09:33.796Z",
|
|
"dateUpdated": "2026-08-05T08:48:14.519Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:48:14.519Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: pch_can: pch_can_rx_normal: fix use after free\n\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\n\nReordering the lines solves the issue."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - The UAF is in the pch_can hardware RX path (PCI interrupt → NAPI → pch_can_rx_normal), triggered by Classical CAN frames arriving on the shared CAN bus; like Bluetooth/WiFi this is limited to the same physical bus segment, not Internet-routable.\nAC:L - Any received frame reliably hits the bug: can_receive() always consume_skb()s the original skb after delivery, so cf (aliasing skb data) is always dangling when cf->len is read; the attacker fully controls frame injection on the bus.\nPR:N - Exploitation requires only the ability to inject unauthenticated CAN frames onto the bus attached to the EG20T PCH controller; no local account or capability on the victim Linux system is needed.\nUI:N - No victim action is required beyond the CAN interface already being operational and receiving, which is the normal deployed state for this controller.\nS:U - Impact is confined to the local kernel's networking/stats path; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - This is a use-after-free of skb/can_frame memory after netif_receive_skb; UAF of freed heap objects can be leveraged for information disclosure (including via the cf->len read into observable rx_bytes stats).\nI:H - Use-after-free of the skb backing store enables heap reuse/spray primitives that can be escalated to integrity compromise and control-flow hijacking under standard kernel UAF exploitation models.\nA:H - The deterministic UAF on every RX frame can cause kernel oops/panic (e.g. under KASAN or when the reclaimed page is unmapped), fully disrupting the system."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/can/pch_can.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "bafe343a885c70dddf358379cf0b2a1c07355d8d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "3a3c46e2eff0577454860a203be1a8295f4acb76",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "affbad02bf80380a7403885b9fe4a1587d1bb4f3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "abb4eff3dcd2e583060082a18a8dbf31f02689d4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "703dde112021c93d6e89443c070e7dbd4dea612e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "6c73fc931658d8cbc8a1714b326cb31eb71d16a7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b21d18b51b31a24d17f883b678432fbdee3d5675",
|
|
"lessThan": "94cddf1e9227a171b27292509d59691819c458db",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/can/pch_can.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.37",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.37",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.4.295",
|
|
"lessThanOrEqual": "4.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.293",
|
|
"lessThanOrEqual": "4.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.258",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.221",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.165",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.85",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.8",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.16",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "4.4.295"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "4.9.293"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "4.14.258"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "4.19.221"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "5.4.165"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "5.10.85"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "5.15.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.37",
|
|
"versionEndExcluding": "5.16"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db"
|
|
}
|
|
],
|
|
"title": "can: pch_can: pch_can_rx_normal: fix use after free",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-06-17T18:03:24.271974Z",
|
|
"id": "CVE-2021-47520",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-06-17T18:03:39.525Z"
|
|
}
|
|
},
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-04T05:39:59.800Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/94cddf1e9227a171b27292509d59691819c458db",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |