In the Linux kernel, the following vulnerability has been resolved:
can: bcm: Fix UAF in bcm_proc_show()
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862
CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0
bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-coreUpgrade perfUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-64k-develUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-abi-stablelistsUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-debugUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade libperfUpgrade kernel-uki-virtUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade rvUpgrade kernel-debug-modules-coreUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-develUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-64k-debugUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-devel-matched | Mar 17, 2025 | Nov 28, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.192-182.736Upgrade kernel-tools-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfoUpgrade bpftool | Mar 14, 2025 | Nov 28, 2024 |
| Debian | — | Upgrade linux | Dec 2, 2024 | Nov 28, 2024 |
| Oracle_linux | — | Upgrade kernel | Mar 13, 2025 | Nov 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Mar 11, 2025 | Nov 28, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade bpftool-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-core | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-5.15Upgrade linux-aws-5.15Upgrade linuxUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-ibm-5.4Upgrade linux-azureUpgrade linux-iotUpgrade linux-raspi-5.4Upgrade linux-nvidia-tegraUpgrade linux-azure-5.4Upgrade linux-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-bluefieldUpgrade linux-xilinx-zynqmpUpgrade linux-lowlatencyUpgrade linux-intel-iotgUpgrade linux-oracle-5.15Upgrade linux-hwe-5.4Upgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-raspiUpgrade linux-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.15Upgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-gcpUpgrade linux-azure-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-ibm-5.15Upgrade linux-gkeUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-realtimeUpgrade linux-aws-5.4 | Dec 20, 2024 | Nov 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Nov 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub