CVE-2024-56651 (GCVE-0-2024-56651)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-08-05 11:45
VLAI
Title
can: hi311x: hi3110_can_ist(): fix potential use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused. Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1 (git)
Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 1128022009444faf49359bd406cd665b177cb643 (git)
Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < bc30b2fe8c54694f8ae08a5b8a5d174d16d93075 (git)
Affected: a22bd630cfff496b270211745536e50e98eb3a45 , < 9ad86d377ef4a19c75a9c639964879a5b25a433b (git)
Affected: 303733fdab728d34708014b3096dc69ebae6e531 (git)
Affected: 410054f1cf75378a6f009359e5952a240102a1a2 (git)
Affected: d20bf7e76136fd4c1e47502a1f5773f2290013ed (git)
Affected: 22e382d47de09e865a9214cc5c9f99256e65deaa (git)
Affected: dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae (git)
Affected: 330b0ac34beec4fef8b002549af5bc6d0b6f0836 (git)
Affected: f3d865a6b791abbc874739ed702ae64ad2607511 (git)
Affected: 4.14.291 , < 4.15 (semver)
Affected: 4.19.256 , < 4.20 (semver)
Affected: 5.4.211 , < 5.5 (semver)
Affected: 5.10.137 , < 5.11 (semver)
Affected: 5.15.61 , < 5.16 (semver)
Affected: 5.18.18 , < 5.19 (semver)
Affected: 5.19.2 , < 5.20 (semver)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:42.778830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:21.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:58.194Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "1128022009444faf49359bd406cd665b177cb643",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "bc30b2fe8c54694f8ae08a5b8a5d174d16d93075",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "lessThan": "9ad86d377ef4a19c75a9c639964879a5b25a433b",
              "status": "affected",
              "version": "a22bd630cfff496b270211745536e50e98eb3a45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303733fdab728d34708014b3096dc69ebae6e531",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "410054f1cf75378a6f009359e5952a240102a1a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d20bf7e76136fd4c1e47502a1f5773f2290013ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22e382d47de09e865a9214cc5c9f99256e65deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "330b0ac34beec4fef8b002549af5bc6d0b6f0836",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3d865a6b791abbc874739ed702ae64ad2607511",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/hi311x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.291",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.256",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.211",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\n\nThe commit a22bd630cfff (\"can: hi311x: do not report txerr and rxerr\nduring bus-off\") removed the reporting of rxerr and txerr even in case\nof correct operation (i. e. not bus-off).\n\nThe error count information added to the CAN frame after netif_rx() is\na potential use after free, since there is no guarantee that the skb\nis in the same state. It might be freed or reused.\n\nFix the issue by postponing the netif_rx() call in case of txerr and\nrxerr reporting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is driven by CAN bus error-state transitions (ERROR_WARNING/ERROR_PASSIVE), which any node sharing the physical CAN segment can force by injecting dominant bits or malformed/unacknowledged frames. CAN is a bounded shared bus, matching the CVSS \"logically adjacent topology\" definition rather than routable Network.\nAC:L - The free is deterministic, not a race \u2014 in threaded-IRQ context netif_rx() drains NET_RX_SOFTIRQ inline via local_bh_enable(), so process_backlog() consumes and frees the skb before netif_rx() returns, and the driver then unconditionally writes through the stale cf pointer. Driving TEC/REC across the error-warning/passive thresholds is entirely under the bus attacker\u0027s control and repeatable.\nPR:N - CAN provides no authentication, addressing, or access control; a peer node needs no credentials or account on the target system to inject the error conditions that trigger the path. The code path is also not gated by any ctrlmode flag or capability check.\nUI:N - No victim action is required \u2014 the CAN interface being up is normal operational state for a deployed device, and the interrupt handler runs automatically on controller error signalling.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed skb buffer is immediately recycled, so subsequent kernel data can occupy it while a socket may still hold references to the corrupted frame, and UAF-corrupted skb metadata can be leveraged to disclose adjacent kernel heap contents.\nI:H - This is a use-after-free write: a bit-set at offset 0 plus two bytes at offsets 14/15 of the freed allocation, with values (txerr/rxerr) the bus attacker influences, repeatable on every error-state transition \u2014 a heap-grooming-friendly write primitive into reallocated kernel objects.\nA:H - Writing into freed and reallocated slab memory corrupts unrelated kernel structures, causing oops, slab corruption, or panic, and the trigger can be repeated indefinitely from the bus."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:48.882Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b"
        }
      ],
      "title": "can: hi311x: hi3110_can_ist(): fix potential use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56651",
    "datePublished": "2024-12-27T15:02:50.759Z",
    "dateReserved": "2024-12-27T15:00:39.841Z",
    "dateUpdated": "2026-08-05T11:45:48.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56651",
      "date": "2026-08-05",
      "epss": "0.00327",
      "percentile": "0.25166"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.14.291\", \"versionEndExcluding\": \"4.15\", \"matchCriteriaId\": \"5A5EEFF9-94C9-4B98-B433-9D09A07C3668\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19.256\", \"versionEndExcluding\": \"4.20\", \"matchCriteriaId\": \"19CB9490-66EF-4751-8782-32A67EFAC5B4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4.211\", \"versionEndExcluding\": \"5.5\", \"matchCriteriaId\": \"64A3E889-7440-4E78-9736-F25D4DB72EC5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.137\", \"versionEndExcluding\": \"5.11\", \"matchCriteriaId\": \"CEFD0208-CE3B-4A8E-9FFB-8F907F7B7D75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.61\", \"versionEndExcluding\": \"5.16\", \"matchCriteriaId\": \"A06E9089-5AE0-4247-B94B-738463428E6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18.18\", \"versionEndExcluding\": \"5.19\", \"matchCriteriaId\": \"B60CAFE2-08C3-461B-B5F8-25BEB0C9853E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19.2\", \"versionEndExcluding\": \"5.20\", \"matchCriteriaId\": \"E8D3E719-D0A1-4044-AB60-B63044B0A1B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.1.120\", \"matchCriteriaId\": \"13A4D14D-6472-491D-817F-86CEABB9D1B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.66\", \"matchCriteriaId\": \"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.5\", \"matchCriteriaId\": \"9501D045-7A94-42CA-8B03-821BE94A65B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\\n\\nThe commit a22bd630cfff (\\\"can: hi311x: do not report txerr and rxerr\\nduring bus-off\\\") removed the reporting of rxerr and txerr even in case\\nof correct operation (i. e. not bus-off).\\n\\nThe error count information added to the CAN frame after netif_rx() is\\na potential use after free, since there is no guarantee that the skb\\nis in the same state. It might be freed or reused.\\n\\nFix the issue by postponing the netif_rx() call in case of txerr and\\nrxerr reporting.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: hi311x: hi3110_can_ist(): corrige un posible use-after-free el commit a22bd630cfff (\\\"can: hi311x: no informar txerr y rxerr durante el apagado del bus\\\") elimin\\u00f3 el informe de rxerr y txerr incluso en caso de funcionamiento correcto (es decir, sin apagado del bus). La informaci\\u00f3n del recuento de errores agregada al marco CAN despu\\u00e9s de netif_rx() es un posible use-after-free, ya que no hay garant\\u00eda de que el skb est\\u00e9 en el mismo estado. Podr\\u00eda liberarse o reutilizarse. Corrija el problema posponiendo la llamada a netif_rx() en caso de informes de txerr y rxerr.\"}]",
      "id": "CVE-2024-56651",
      "lastModified": "2025-01-06T19:33:57.000",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-12-27T15:15:24.917",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56651\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:24.917\",\"lastModified\":\"2026-08-04T11:22:17.520\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\\n\\nThe commit a22bd630cfff (\\\"can: hi311x: do not report txerr and rxerr\\nduring bus-off\\\") removed the reporting of rxerr and txerr even in case\\nof correct operation (i. e. not bus-off).\\n\\nThe error count information added to the CAN frame after netif_rx() is\\na potential use after free, since there is no guarantee that the skb\\nis in the same state. It might be freed or reused.\\n\\nFix the issue by postponing the netif_rx() call in case of txerr and\\nrxerr reporting.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: hi311x: hi3110_can_ist(): corrige un posible use-after-free el commit a22bd630cfff (\\\"can: hi311x: no informar txerr y rxerr durante el apagado del bus\\\") elimin\u00f3 el informe de rxerr y txerr incluso en caso de funcionamiento correcto (es decir, sin apagado del bus). La informaci\u00f3n del recuento de errores agregada al marco CAN despu\u00e9s de netif_rx() es un posible use-after-free, ya que no hay garant\u00eda de que el skb est\u00e9 en el mismo estado. Podr\u00eda liberarse o reutilizarse. Corrija el problema posponiendo la llamada a netif_rx() en caso de informes de txerr y rxerr.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/can/spi/hi311x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a22bd630cfff496b270211745536e50e98eb3a45\",\"lessThan\":\"4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a22bd630cfff496b270211745536e50e98eb3a45\",\"lessThan\":\"1128022009444faf49359bd406cd665b177cb643\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a22bd630cfff496b270211745536e50e98eb3a45\",\"lessThan\":\"bc30b2fe8c54694f8ae08a5b8a5d174d16d93075\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a22bd630cfff496b270211745536e50e98eb3a45\",\"lessThan\":\"9ad86d377ef4a19c75a9c639964879a5b25a433b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303733fdab728d34708014b3096dc69ebae6e531\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"410054f1cf75378a6f009359e5952a240102a1a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d20bf7e76136fd4c1e47502a1f5773f2290013ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22e382d47de09e865a9214cc5c9f99256e65deaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"330b0ac34beec4fef8b002549af5bc6d0b6f0836\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3d865a6b791abbc874739ed702ae64ad2607511\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.291\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.256\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.211\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.137\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.61\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.18\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.19.2\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/can/spi/hi311x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:41:42.778830Z\",\"id\":\"CVE-2024-56651\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.291\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"5A5EEFF9-94C9-4B98-B433-9D09A07C3668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.256\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"19CB9490-66EF-4751-8782-32A67EFAC5B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.211\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"64A3E889-7440-4E78-9736-F25D4DB72EC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.137\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"CEFD0208-CE3B-4A8E-9FFB-8F907F7B7D75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.61\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"A06E9089-5AE0-4247-B94B-738463428E6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.18\",\"versionEndExcluding\":\"5.19\",\"matchCriteriaId\":\"B60CAFE2-08C3-461B-B5F8-25BEB0C9853E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.2\",\"versionEndExcluding\":\"5.20\",\"matchCriteriaId\":\"E8D3E719-D0A1-4044-AB60-B63044B0A1B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"13A4D14D-6472-491D-817F-86CEABB9D1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:58:15+00:00",
      "cve": "CVE-2024-56651",
      "id": "CVE-2024-56651",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: hi311x: hi3110_can_ist(): fix potential use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56651.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T01:17:44Z",
      "cve": "CVE-2024-56651",
      "id": "CVE-2024-56651",
      "initial_release_date": "2025-01-10T00:21:35Z",
      "product_status:known_affected": "405",
      "product_status:known_not_affected": "160",
      "product_status:recommended": "655",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56651",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56651.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:51:58.194Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56651\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:41:42.778830Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:41:44.247Z\"}}], \"cna\": {\"title\": \"can: hi311x: hi3110_can_ist(): fix potential use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable path is driven by CAN bus error-state transitions (ERROR_WARNING/ERROR_PASSIVE), which any node sharing the physical CAN segment can force by injecting dominant bits or malformed/unacknowledged frames. CAN is a bounded shared bus, matching the CVSS \\\"logically adjacent topology\\\" definition rather than routable Network.\\nAC:L - The free is deterministic, not a race \\u2014 in threaded-IRQ context netif_rx() drains NET_RX_SOFTIRQ inline via local_bh_enable(), so process_backlog() consumes and frees the skb before netif_rx() returns, and the driver then unconditionally writes through the stale cf pointer. Driving TEC/REC across the error-warning/passive thresholds is entirely under the bus attacker\u0027s control and repeatable.\\nPR:N - CAN provides no authentication, addressing, or access control; a peer node needs no credentials or account on the target system to inject the error conditions that trigger the path. The code path is also not gated by any ctrlmode flag or capability check.\\nUI:N - No victim action is required \\u2014 the CAN interface being up is normal operational state for a deployed device, and the interrupt handler runs automatically on controller error signalling.\\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The freed skb buffer is immediately recycled, so subsequent kernel data can occupy it while a socket may still hold references to the corrupted frame, and UAF-corrupted skb metadata can be leveraged to disclose adjacent kernel heap contents.\\nI:H - This is a use-after-free write: a bit-set at offset 0 plus two bytes at offsets 14/15 of the freed allocation, with values (txerr/rxerr) the bus attacker influences, repeatable on every error-state transition \\u2014 a heap-grooming-friendly write primitive into reallocated kernel objects.\\nA:H - Writing into freed and reallocated slab memory corrupts unrelated kernel structures, causing oops, slab corruption, or panic, and the trigger can be repeated indefinitely from the bus.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a22bd630cfff496b270211745536e50e98eb3a45\", \"lessThan\": \"4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a22bd630cfff496b270211745536e50e98eb3a45\", \"lessThan\": \"1128022009444faf49359bd406cd665b177cb643\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a22bd630cfff496b270211745536e50e98eb3a45\", \"lessThan\": \"bc30b2fe8c54694f8ae08a5b8a5d174d16d93075\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a22bd630cfff496b270211745536e50e98eb3a45\", \"lessThan\": \"9ad86d377ef4a19c75a9c639964879a5b25a433b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"303733fdab728d34708014b3096dc69ebae6e531\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"410054f1cf75378a6f009359e5952a240102a1a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20bf7e76136fd4c1e47502a1f5773f2290013ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"22e382d47de09e865a9214cc5c9f99256e65deaa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcfcd5fc999b1eb7946de1fd031bc3aaf224c5ae\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"330b0ac34beec4fef8b002549af5bc6d0b6f0836\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3d865a6b791abbc874739ed702ae64ad2607511\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.14.291\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.256\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.211\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.137\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.61\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.18.18\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.19.2\", \"lessThan\": \"5.20\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/can/spi/hi311x.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/can/spi/hi311x.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1\"}, {\"url\": \"https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643\"}, {\"url\": \"https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075\"}, {\"url\": \"https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: hi311x: hi3110_can_ist(): fix potential use-after-free\\n\\nThe commit a22bd630cfff (\\\"can: hi311x: do not report txerr and rxerr\\nduring bus-off\\\") removed the reporting of rxerr and txerr even in case\\nof correct operation (i. e. not bus-off).\\n\\nThe error count information added to the CAN frame after netif_rx() is\\na potential use after free, since there is no guarantee that the skb\\nis in the same state. It might be freed or reused.\\n\\nFix the issue by postponing the netif_rx() call in case of txerr and\\nrxerr reporting.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.291\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.256\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.211\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.137\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.15.61\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.19.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:48.882Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56651\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:48.882Z\", \"dateReserved\": \"2024-12-27T15:00:39.841Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:50.759Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.