CVE-2021-47456

can: peak_pci: peak_pci_remove(): fix UAF

State: Published
Severity: 8.4 High
Published: May 22, 2024
Updated: May 11, 2026
Reserved: May 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_pci: peak_pci_remove(): fix UAF

When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513 ] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ] print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0 [ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ] pci_device_remove+0xa9/0x250

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free
CWE-467 Use of sizeof() on a Pointer Type

Affected Products

Product	Versions
LinuxLinux	e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 1c616528ba4aeb1125a06b407572ab7b56acae38Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 447d44cd2f67a20b596ede3ca3cd67086dfd9ca9Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 34914971bb3244db4ce2be44e9438a9b30c56250Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before adbda14730aacce41c0d3596415aa39ad63eafd9Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 1248582e47a9f7ce0ecd156c39fc61f8b6aa3699Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 28f28e4bc3a5e0051faa963f10b778ab38c1db69Affected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 0e5afdc2315b0737edcf55bede4ee1640d2d464dAffected e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 949fe9b35570361bc6ee2652f89a0561b26eec98Affected
LinuxLinux	3.4Affected before 3.4Not affected 4.4.290 through 4.4.Not affected 4.9.288 through 4.9.Not affected 4.14.253 through 4.14.Not affected 4.19.214 through 4.19.Not affected 5.4.156 through 5.4.Not affected 5.10.76 through 5.10.Not affected 5.14.15 through 5.14.*Not affected 5.15 and laterNot affected

Product

Versions

LinuxLinux

e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 1c616528ba4aeb1125a06b407572ab7b56acae38Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 447d44cd2f67a20b596ede3ca3cd67086dfd9ca9Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 34914971bb3244db4ce2be44e9438a9b30c56250Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before adbda14730aacce41c0d3596415aa39ad63eafd9Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 1248582e47a9f7ce0ecd156c39fc61f8b6aa3699Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 28f28e4bc3a5e0051faa963f10b778ab38c1db69Affected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 0e5afdc2315b0737edcf55bede4ee1640d2d464dAffected
e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd to before 949fe9b35570361bc6ee2652f89a0561b26eec98Affected

LinuxLinux

3.4Affected
before 3.4Not affected
4.4.290 through 4.4.*Not affected
4.9.288 through 4.9.*Not affected
4.14.253 through 4.14.*Not affected
4.19.214 through 4.19.*Not affected
5.4.156 through 5.4.*Not affected
5.10.76 through 5.10.*Not affected
5.14.15 through 5.14.*Not affected
5.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.