UAF Vulnerability in j1939_netdev_start() of Kernel
Summary
GSD-2021-1001821: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv. Affects Kernel versions >= 9d71dd0c70099914fcd063135da3c580865e924c, < a0e47d2833b4f65e6c799f28c6b636d36b8b936d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the overall stability and security of the system. The j1939_netdev_start() function is a part of the Controller Area Network (CAN) subsystem in the Kernel, specifically related to the J1939 protocol. This protocol is commonly used in automotive and industrial applications for communication between electronic control units (ECUs). The j1939_netdev_start() function is responsible for initializing the network device for J1939 communication. However, a use-after-free (UAF) vulnerability exists in this function, which can lead to potential security issues.
Vulnerability Detail
The UAF vulnerability in j1939_netdev_start() arises due to improper handling of the rx_kref object in the j1939_priv structure. When the network device is started, the function fails to properly manage the reference count of the rx_kref object, leading to a use-after-free scenario. An attacker could potentially exploit this vulnerability by triggering the use of the freed memory, resulting in a crash or potentially executing arbitrary code in the context of the Kernel. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the fix commit a0e47d2833b4f65e6c799f28c6b636d36b8b936d to the affected Kernel version. The patch modifies the j1939_netdev_start() function to properly handle the rx_kref object and prevent the use-after-free vulnerability. Here is the code snippet of the patch:
- // Vulnerable code
- // ...
- kref_put(&priv->rx_kref, j1939_priv_release);
- // ...
+ // Patched code
+ // ...
+ if (priv->rx_kref) {
+ kref_put(&priv->rx_kref, j1939_priv_release);
+ priv->rx_kref = NULL;
+ }
+ // ...
Conclusion
The UAF vulnerability in j1939_netdev_start() of the Kernel can potentially lead to security issues if successfully exploited. It is crucial to update the Kernel to version v5.4.156 or later to mitigate this vulnerability. Regularly updating the Kernel is recommended to ensure the latest security patches and fixes are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The j1939_netdev_start() function is a part of the CAN subsystem in the Linux Kernel, specifically related to the J1939 protocol. It is responsible for initializing the network device for J1939 communication.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including crashes, memory corruption, and potential execution of arbitrary code.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could result in a crash or potential execution of arbitrary code in the context of the Kernel.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.156 or later, where the issue has been resolved.
Yes, a workaround is available by applying the patch provided in the fix commit a0e47d2833b4f65e6c799f28c6b636d36b8b936d to the affected Kernel version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
