248 lines
12 KiB
JSON
248 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2021-47459",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-05-22T06:20:56.197Z",
|
||
"datePublished": "2024-05-22T06:23:21.061Z",
|
||
"dateUpdated": "2026-08-05T08:47:56.231Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:47:56.231Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv\n\nIt will trigger UAF for rx_kref of j1939_priv as following.\n\n cpu0 cpu1\nj1939_sk_bind(socket0, ndev0, ...)\nj1939_netdev_start\n j1939_sk_bind(socket1, ndev0, ...)\n j1939_netdev_start\nj1939_priv_set\n j1939_priv_get_by_ndev_locked\nj1939_jsk_add\n.....\nj1939_netdev_stop\nkref_put_lock(&priv->rx_kref, ...)\n kref_get(&priv->rx_kref, ...)\n REFCOUNT_WARN(\"addition on 0;...\")\n\n====================================================\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0\nRIP: 0010:refcount_warn_saturate+0x169/0x1e0\nCall Trace:\n j1939_netdev_start+0x68b/0x920\n j1939_sk_bind+0x426/0xeb0\n ? security_socket_bind+0x83/0xb0\n\nThe rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to\nprotect."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is reached only through local syscalls (socket/bind/close) into j1939_sk_bind → j1939_netdev_start/stop; it is not triggered by receiving CAN/J1939 frames from the wire.\nAC:L - The race is fully attacker-controlled by opening multiple J1939 sockets and concurrently binding/closing them on the same CAN interface, as demonstrated by the syzbot threaded reproducers.\nPR:L - Creating and binding CAN_J1939 sockets requires no capabilities; an unprivileged user can reach the path on an existing UP CAN device or by creating vcan in a user/net namespace with namespaced CAP_NET_ADMIN.\nUI:N - Exploitation requires no victim action beyond the attacker’s own socket operations.\nS:U - This is a standard in-kernel memory-safety flaw affecting the host kernel authority, with no VM/IOMMU/sandbox boundary crossing.\nC:H - The vulnerability is a use-after-free on j1939_priv refcounting; UAF enables reclaim/spray of the freed object and arbitrary kernel memory disclosure.\nI:H - Use-after-free of j1939_priv state enables heap manipulation and write primitives sufficient for control-flow hijacking or arbitrary kernel writes.\nA:H - The UAF reliably produces refcount warnings and kernel oops/crash conditions even without full exploitation, denying availability."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/can/j1939/main.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
|
||
"lessThan": "a0e47d2833b4f65e6c799f28c6b636d36b8b936d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
|
||
"lessThan": "864e77771a24c877aaf53aee019f78619cbcd668",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
|
||
"lessThan": "6e8811707e2df0c6ba920f0cad3a3bca7b42132f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
|
||
"lessThan": "d9d52a3ebd284882f5562c88e55991add5d01586",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/can/j1939/main.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.4",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.4",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.156",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.76",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.14.15",
|
||
"lessThanOrEqual": "5.14.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.4",
|
||
"versionEndExcluding": "5.4.156"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.4",
|
||
"versionEndExcluding": "5.10.76"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.4",
|
||
"versionEndExcluding": "5.14.15"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.4",
|
||
"versionEndExcluding": "5.15"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586"
|
||
}
|
||
],
|
||
"title": "can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T05:39:59.451Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2021-47459",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-09-10T15:36:14.848678Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-11T17:33:25.941Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |