In the Linux kernel, the following vulnerability has been resolved:
can: bcm: Fix UAF in bcm_proc_show()
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862
CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0
bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rtUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debugUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modules-coreUpgrade python3-perfUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-64kUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade rvUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debugUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-modulesUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade libperfUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-modules-core | Mar 17, 2025 | Nov 28, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.10.192-182.736Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-devel | Mar 14, 2025 | Nov 28, 2024 |
| Debian | — | Upgrade linux | Dec 2, 2024 | Nov 28, 2024 |
| Oracle_linux | — | Upgrade kernel | Mar 13, 2025 | Nov 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Mar 11, 2025 | Nov 28, 2024 |
| Rocky_linux | — | Upgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-coreUpgrade kernel-toolsUpgrade perfUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-rt-kvmUpgrade kernel-rt-debuginfoUpgrade kernel-headersUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-debug-kvm | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-fipsUpgrade linux-azure-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.15Upgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-realtimeUpgrade linux-gcpUpgrade linux-aws-fipsUpgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-aws-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.4Upgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-ibmUpgrade linux-xilinx-zynqmpUpgrade linux-oracleUpgrade linux-ibm-5.15Upgrade linux-gkeUpgrade linux-intel-iotgUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-lowlatencyUpgrade linux-azure-5.4Upgrade linux-nvidia-tegraUpgrade linux-bluefieldUpgrade linux-ibm-5.4Upgrade linux-aws-5.15Upgrade linux-gcp-fipsUpgrade linux-iotUpgrade linux-azureUpgrade linuxUpgrade linux-raspi-5.4Upgrade linux-nvidia-tegra-5.15Upgrade linux-hwe-5.15Upgrade linux-awsUpgrade linux-lowlatency-hwe-5.15 | Dec 20, 2024 | Nov 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Nov 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub