Use-after-Free Vulnerability in can: j1939 Package
Summary
UVI-2021-1001076: can: j1939: fix Use-after-Free, hold skb ref while in use. Affects Kernel versions >= 9d71dd0c70099914fcd063135da3c580865e924c, < 1071065eeb33d32b7d98c2ce7591881ae7381705. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The can: j1939 package is a component of the Linux Kernel ecosystem. It provides support for the J1939 protocol, which is commonly used in heavy-duty vehicles for communication between electronic control units (ECUs). The package allows ECUs to exchange messages and perform various functions related to vehicle control and diagnostics. However, a vulnerability has been discovered in the can: j1939 package that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the can: j1939 package is a Use-after-Free issue. It occurs when a reference to a socket buffer (skb) is released prematurely, but still accessed afterwards. This can lead to a situation where an attacker can manipulate the freed skb object, potentially causing a crash or executing arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v5.4 of the Linux Kernel and has been fixed in version v5.12.13.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The Use-after-Free vulnerability in the can: j1939 package of the Linux Kernel has been identified and fixed in version v5.12.13. It is recommended to update to this version to ensure the security and stability of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The can: j1939 package is a component of the Linux Kernel ecosystem that provides support for the J1939 protocol used in heavy-duty vehicles.
A Use-after-Free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or code execution.
The impact of this vulnerability is currently unknown. It could potentially allow attackers to manipulate freed memory and execute arbitrary code.
To fix this vulnerability, update the Linux Kernel to version v5.12.13 or later.
The updated version of the Linux Kernel can be obtained from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
