Vulnerability-Lookup

FKIE_CVE-2024-56651

Vulnerability from fkie_nvd - Published: 2024-12-27 15:15 - Updated: 2026-08-04 11:22

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.13

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "1128022009444faf49359bd406cd665b177cb643",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "bc30b2fe8c54694f8ae08a5b8a5d174d16d93075",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "9ad86d377ef4a19c75a9c639964879a5b25a433b",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303733fdab728d34708014b3096dc69ebae6e531",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "410054f1cf75378a6f009359e5952a240102a1a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d20bf7e76136fd4c1e47502a1f5773f2290013ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22e382d47de09e865a9214cc5c9f99256e65deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "330b0ac34beec4fef8b002549af5bc6d0b6f0836",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3d865a6b791abbc874739ed702ae64ad2607511",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A5EEFF9-94C9-4B98-B433-9D09A07C3668",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.291",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "19CB9490-66EF-4751-8782-32A67EFAC5B4",
              "versionEndExcluding": "4.20",
              "versionStartIncluding": "4.19.256",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64A3E889-7440-4E78-9736-F25D4DB72EC5",
              "versionEndExcluding": "5.5",
              "versionStartIncluding": "5.4.211",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEFD0208-CE3B-4A8E-9FFB-8F907F7B7D75",
              "versionEndExcluding": "5.11",
              "versionStartIncluding": "5.10.137",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A06E9089-5AE0-4247-B94B-738463428E6D",
              "versionEndExcluding": "5.16",
              "versionStartIncluding": "5.15.61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B60CAFE2-08C3-461B-B5F8-25BEB0C9853E",
              "versionEndExcluding": "5.19",
              "versionStartIncluding": "5.18.18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D3E719-D0A1-4044-AB60-B63044B0A1B3",
              "versionEndExcluding": "5.20",
              "versionStartIncluding": "5.19.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13A4D14D-6472-491D-817F-86CEABB9D1B9",
              "versionEndExcluding": "6.1.120",
              "versionStartIncluding": "6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "29A976AD-B9AB-4A95-9F08-7669F8847EB9",
              "versionEndExcluding": "6.6.66",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7",
              "versionEndExcluding": "6.12.5",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\n\nThe commit a22bd630cfff (\"can: hi311x: do not report txerr and rxerr\nduring bus-off\") removed the reporting of rxerr and txerr even in case\nof correct operation (i. e. not bus-off).\n\nThe error count information added to the CAN frame after netif_rx() is\na potential use after free, since there is no guarantee that the skb\nis in the same state. It might be freed or reused.\n\nFix the issue by postponing the netif_rx() call in case of txerr and\nrxerr reporting."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: hi311x: hi3110_can_ist(): corrige un posible use-after-free el commit a22bd630cfff (\"can: hi311x: no informar txerr y rxerr durante el apagado del bus\") elimin\u00f3 el informe de rxerr y txerr incluso en caso de funcionamiento correcto (es decir, sin apagado del bus). La informaci\u00f3n del recuento de errores agregada al marco CAN despu\u00e9s de netif_rx() es un posible use-after-free, ya que no hay garant\u00eda de que el skb est\u00e9 en el mismo estado. Podr\u00eda liberarse o reutilizarse. Corrija el problema posponiendo la llamada a netif_rx() en caso de informes de txerr y rxerr."
    }
  ],
  "id": "CVE-2024-56651",
  "lastModified": "2026-08-04T11:22:17.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-56651",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-11T15:41:42.778830Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-12-27T15:15:24.917",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2024-56651 (GCVE-0-2024-56651)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-08-05 11:45

Title

can: hi311x: hi3110_can_ist(): fix potential use-after-free

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-11 15:41 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root Scorecard

References

5 references

URL	Tags
https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa…
https://git.kernel.org/stable/c/1128022009444faf4…
https://git.kernel.org/stable/c/bc30b2fe8c54694f8…
https://git.kernel.org/stable/c/9ad86d377ef4a19c7…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1 (git) Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 1128022009444faf49359bd406cd665b177cb643 (git) Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < bc30b2fe8c54694f8ae08a5b8a5d174d16d93075 (git) Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 9ad86d377ef4a19c75a9c639964879a5b25a433b (git) Affected: 303733fdab728d34708014b3096dc69ebae6e531 (git) Affected: 410054f1cf75378a6f009359e5952a240102a1a2 (git) Affected: d20bf7e76136fd4c1e47502a1f5773f2290013ed (git) Affected: 22e382d47de09e865a9214cc5c9f99256e65deaa (git) Affected: dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae (git) Affected: 330b0ac34beec4fef8b002549af5bc6d0b6f0836 (git) Affected: f3d865a6b791abbc874739ed702ae64ad2607511 (git) Affected: 4.14.291 , < 4.15 (semver) Affected: 4.19.256 , < 4.20 (semver) Affected: 5.4.211 , < 5.5 (semver) Affected: 5.10.137 , < 5.11 (semver) Affected: 5.15.61 , < 5.16 (semver) Affected: 5.18.18 , < 5.19 (semver) Affected: 5.19.2 , < 5.20 (semver)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:42.778830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:21.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:58.194Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "1128022009444faf49359bd406cd665b177cb643",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "bc30b2fe8c54694f8ae08a5b8a5d174d16d93075",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "9ad86d377ef4a19c75a9c639964879a5b25a433b",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303733fdab728d34708014b3096dc69ebae6e531",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "410054f1cf75378a6f009359e5952a240102a1a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d20bf7e76136fd4c1e47502a1f5773f2290013ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22e382d47de09e865a9214cc5c9f99256e65deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "330b0ac34beec4fef8b002549af5bc6d0b6f0836",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3d865a6b791abbc874739ed702ae64ad2607511",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.291",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.256",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.211",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\n\nThe commit a22bd630cfff (\"can: hi311x: do not report txerr and rxerr\nduring bus-off\") removed the reporting of rxerr and txerr even in case\nof correct operation (i. e. not bus-off).\n\nThe error count information added to the CAN frame after netif_rx() is\na potential use after free, since there is no guarantee that the skb\nis in the same state. It might be freed or reused.\n\nFix the issue by postponing the netif_rx() call in case of txerr and\nrxerr reporting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is driven by CAN bus error-state transitions (ERROR_WARNING/ERROR_PASSIVE), which any node sharing the physical CAN segment can force by injecting dominant bits or malformed/unacknowledged frames. CAN is a bounded shared bus, matching the CVSS \"logically adjacent topology\" definition rather than routable Network.\nAC:L - The free is deterministic, not a race \u2014 in threaded-IRQ context netif_rx() drains NET_RX_SOFTIRQ inline via local_bh_enable(), so process_backlog() consumes and frees the skb before netif_rx() returns, and the driver then unconditionally writes through the stale cf pointer. Driving TEC/REC across the error-warning/passive thresholds is entirely under the bus attacker\u0027s control and repeatable.\nPR:N - CAN provides no authentication, addressing, or access control; a peer node needs no credentials or account on the target system to inject the error conditions that trigger the path. The code path is also not gated by any ctrlmode flag or capability check.\nUI:N - No victim action is required \u2014 the CAN interface being up is normal operational state for a deployed device, and the interrupt handler runs automatically on controller error signalling.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed skb buffer is immediately recycled, so subsequent kernel data can occupy it while a socket may still hold references to the corrupted frame, and UAF-corrupted skb metadata can be leveraged to disclose adjacent kernel heap contents.\nI:H - This is a use-after-free write: a bit-set at offset 0 plus two bytes at offsets 14/15 of the freed allocation, with values (txerr/rxerr) the bus attacker influences, repeatable on every error-state transition \u2014 a heap-grooming-friendly write primitive into reallocated kernel objects.\nA:H - Writing into freed and reallocated slab memory corrupts unrelated kernel structures, causing oops, slab corruption, or panic, and the trigger can be repeated indefinitely from the bus."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:48.882Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b"
        }
      ],
      "title": "can: hi311x: hi3110_can_ist(): fix potential use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56651",
    "datePublished": "2024-12-27T15:02:50.759Z",
    "dateReserved": "2024-12-27T15:00:39.841Z",
    "dateUpdated": "2026-08-05T11:45:48.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2024-56651

CVE-2024-56651 (GCVE-0-2024-56651)

Tags

Sightings

Nomenclature

Related by attack behaviour