CVE-2024-56651

can: hi311x: hi3110_can_ist(): fix potential use-after-free

State: Published
Severity: 8.8 High
Published: Dec 27, 2024
Updated: Aug 5, 2026
Reserved: Dec 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: hi3110_can_ist(): fix potential use-after-free

The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off).

The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused.

Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	a22bd630cfff496b270211745536e50e98eb3a45 to before 4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1Affected a22bd630cfff496b270211745536e50e98eb3a45 to before 1128022009444faf49359bd406cd665b177cb643Affected a22bd630cfff496b270211745536e50e98eb3a45 to before bc30b2fe8c54694f8ae08a5b8a5d174d16d93075Affected a22bd630cfff496b270211745536e50e98eb3a45 to before 9ad86d377ef4a19c75a9c639964879a5b25a433bAffected 303733fdab728d34708014b3096dc69ebae6e531Affected 410054f1cf75378a6f009359e5952a240102a1a2Affected d20bf7e76136fd4c1e47502a1f5773f2290013edAffected 22e382d47de09e865a9214cc5c9f99256e65deaaAffected dcfcd5fc999b1eb7946de1fd031bc3aaf224c5aeAffected 330b0ac34beec4fef8b002549af5bc6d0b6f0836Affected f3d865a6b791abbc874739ed702ae64ad2607511Affected 4.14.291 to before 4.15Affected 4.19.256 to before 4.20Affected 5.4.211 to before 5.5Affected 5.10.137 to before 5.11Affected 5.15.61 to before 5.16Affected 5.18.18 to before 5.19Affected 5.19.2 to before 5.20Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.120 through 6.1.Not affected 6.6.66 through 6.6.Not affected 6.12.5 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

a22bd630cfff496b270211745536e50e98eb3a45 to before 4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1Affected
a22bd630cfff496b270211745536e50e98eb3a45 to before 1128022009444faf49359bd406cd665b177cb643Affected
a22bd630cfff496b270211745536e50e98eb3a45 to before bc30b2fe8c54694f8ae08a5b8a5d174d16d93075Affected
a22bd630cfff496b270211745536e50e98eb3a45 to before 9ad86d377ef4a19c75a9c639964879a5b25a433bAffected
303733fdab728d34708014b3096dc69ebae6e531Affected
410054f1cf75378a6f009359e5952a240102a1a2Affected
d20bf7e76136fd4c1e47502a1f5773f2290013edAffected
22e382d47de09e865a9214cc5c9f99256e65deaaAffected
dcfcd5fc999b1eb7946de1fd031bc3aaf224c5aeAffected
330b0ac34beec4fef8b002549af5bc6d0b6f0836Affected
f3d865a6b791abbc874739ed702ae64ad2607511Affected
4.14.291 to before 4.15Affected
4.19.256 to before 4.20Affected
5.4.211 to before 5.5Affected
5.10.137 to before 5.11Affected
5.15.61 to before 5.16Affected
5.18.18 to before 5.19Affected
5.19.2 to before 5.20Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.120 through 6.1.*Not affected
6.6.66 through 6.6.*Not affected
6.12.5 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.