Use-after-Free Vulnerability in can: j1939 Package
Summary
GSD-2021-1000928: can: j1939: fix Use-after-Free, hold skb ref while in use. Affects Kernel versions >= 9d71dd0c70099914fcd063135da3c580865e924c, < 22cba878abf646cd3a02ee7c8c2cef7afe66a256. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The can: j1939 package is a component of the Linux Kernel ecosystem. It provides support for the J1939 protocol, which is commonly used in heavy-duty vehicles for communication between electronic control units (ECUs). The package allows ECUs to exchange messages over a Controller Area Network (CAN). However, a vulnerability has been discovered in the package that could lead to a Use-after-Free scenario.
Vulnerability Detail
The Use-after-Free vulnerability in the can: j1939 package occurs when a reference to a socket buffer (skb) is released prematurely, but still accessed later. This can result in a situation where the memory previously occupied by the skb is reused for other purposes, leading to potential memory corruption or crashes. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Use-after-Free vulnerability in the can: j1939 package of the Linux Kernel can potentially lead to memory corruption or crashes. It is crucial to update the kernel to version v5.4.128 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The can: j1939 package is a component of the Linux Kernel ecosystem that provides support for the J1939 protocol used in heavy-duty vehicles.
A Use-after-Free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption or crashes.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
To fix this vulnerability, update the Linux Kernel to version v5.4.128 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
