In the Linux kernel, the following vulnerability has been resolved:
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets.
Following trace was seen on affected system: ================================================================== BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] Read of size 4 at addr ffff888012144014 by task j1939/350
CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: print_report+0xd3/0x620 ? kasan_complete_mode_report_info+0x7d/0x200 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] kasan_report+0xc2/0x100 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] __asan_load4+0x84/0xb0 j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] j1939_sk_recv+0x20b/0x320 [can_j1939] ? __kasan_check_write+0x18/0x20 ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939] ? j1939_simple_recv+0x69/0x280 [can_j1939] ? j1939_ac_recv+0x5e/0x310 [can_j1939] j1939_can_recv+0x43f/0x580 [can_j1939] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] ? raw_rcv+0x42/0x3c0 [can_raw] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] can_rcv_filter+0x11f/0x350 [can] can_receive+0x12f/0x190 [can] ? __pfx_can_rcv+0x10/0x10 [can] can_rcv+0xdd/0x130 [can] ? __pfx_can_rcv+0x10/0x10 [can] __netif_receive_skb_one_core+0x13d/0x150 ? __pfx___netif_receive_skb_one_core+0x10/0x10 ? __kasan_check_write+0x18/0x20 ? _raw_spin_lock_irq+0x8c/0xe0 __netif_receive_skb+0x23/0xb0 process_backlog+0x107/0x260 __napi_poll+0x69/0x310 net_rx_action+0x2a1/0x580 ? __pfx_net_rx_action+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? handle_irq_event+0x7d/0xa0 __do_softirq+0xf3/0x3f8 do_softirq+0x53/0x80 </IRQ> <TASK> __local_bh_enable_ip+0x6e/0x70 netif_rx+0x16b/0x180 can_send+0x32b/0x520 [can] ? __pfx_can_send+0x10/0x10 [can] ? __check_object_size+0x299/0x410 raw_sendmsg+0x572/0x6d0 [can_raw] ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] ? apparmor_socket_sendmsg+0x2f/0x40 ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] sock_sendmsg+0xef/0x100 sock_write_iter+0x162/0x220 ? __pfx_sock_write_iter+0x10/0x10 ? __rtnl_unlock+0x47/0x80 ? security_file_permission+0x54/0x320 vfs_write+0x6ba/0x750 ? __pfx_vfs_write+0x10/0x10 ? __fget_light+0x1ca/0x1f0 ? __rcu_read_unlock+0x5b/0x280 ksys_write+0x143/0x170 ? __pfx_ksys_write+0x10/0x10 ? __kasan_check_read+0x15/0x20 ? fpregs_assert_state_consistent+0x62/0x70 __x64_sys_write+0x47/0x60 do_syscall_64+0x60/0x90 ? do_syscall_64+0x6d/0x90 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x79/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Allocated by task 348: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_alloc_info+0x1f/0x30 __kasan_kmalloc+0xb5/0xc0 __kmalloc_node_track_caller+0x67/0x160 j1939_sk_setsockopt+0x284/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 349: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_free_info+0x2f/0x50 __kasan_slab_free+0x12e/0x1c0 __kmem_cache_free+0x1b9/0x380 kfree+0x7a/0x120 j1939_sk_setsockopt+0x3b2/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade python-perfUpgrade kernel-livepatch-5.10.210-201.852Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Dec 12, 2024 | Apr 3, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 3, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Dec 5, 2024 | Apr 3, 2024 |
| Suse | — | Upgrade kernel-devel-rtUpgrade kernel-rt-livepatchUpgrade dtb-lgUpgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-qaUpgrade gfs2-kmp-azureUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade dtb-caviumUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-rt-extraUpgrade kernel-azure-livepatch-develUpgrade dtb-apmUpgrade dtb-xilinxUpgrade kernel-source-vanillaUpgrade dtb-exynosUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade dtb-mediatekUpgrade kernel-debug-livepatch-develUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade kernel-kvmsmall-develUpgrade kernel-azureUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-broadcomUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade dtb-renesasUpgrade kernel-default-develUpgrade kernel-docs-htmlUpgrade dtb-amdUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade dtb-appleUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade kernel-rt_debug-develUpgrade kernel-symsUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-optional | Apr 18, 2024 | Apr 3, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1112-kvmUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-22.04dUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-181-genericUpgrade linux-image-5.4.0-1128-gcpUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-virtualUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-oem-osp1Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-bluefieldUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1036-iotUpgrade linux-image-5.4.0-1091-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-oemUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.5.0-1023-awsUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-6.5.0-1024-azureUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1108-raspiUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1124-awsUpgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-azure-cvmUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-5.4.0-1084-bluefieldUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-intelUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-1123-oracleUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-gke-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-181-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.4.0-1129-azureUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-starfiveUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-raspi2Upgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-181-generic-lpaeUpgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-5.4.0-1043-xilinx-zynqmpUpgrade linux-image-5.4.0-1071-ibmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-genericUpgrade linux-image-gkeop-5.4Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-ibmUpgrade linux-image-azure-fdeUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-oem-22.04aUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-6.5.0-1024-azure-fde | May 17, 2024 | Apr 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub