Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2021-47670

can: peak_usb: fix use after free bugs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0a25e1f4f18566b750ebd3ae995af64e23111e63 to < 5408824636fa0dfedb9ecb0d94abd573131bfbbeaffected
  • 0a25e1f4f18566b750ebd3ae995af64e23111e63 to < ddd1416f44130377798c1430b76503513b7497c2affected
  • 0a25e1f4f18566b750ebd3ae995af64e23111e63 to < ec939c13c3fff2114479769c8380b7f1a54feca9affected
  • 0a25e1f4f18566b750ebd3ae995af64e23111e63 to < 50aca891d7a554db0901b245167cd653d73aaa71affected

Linux Linux

Default version status: affected

  • 4.0affected
  • 0 to < 4.0unaffected
  • 4.19.171 to ≤ 4.19.*unaffected
  • 5.4.93 to ≤ 5.4.*unaffected
  • 5.10.11 to ≤ 5.10.*unaffected
  • 5.11 to ≤ *unaffected

References