CVE-2024-56651

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: hi3110_can_ist(): fix potential use-after-free

The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off).

The error count information added to the CAN frame after netif_rx() is a potential use after free, since there is no guarantee that the skb is in the same state. It might be freed or reused.

Fix the issue by postponing the netif_rx() call in case of txerr and rxerr reporting.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access alongside specialized Controller Area Network (CAN) hardware utilizing the Holt HI-3110 SPI controller. The issue stems from handling error counters on network packet buffers after submission to the networking stack, which could trigger a use-after-free condition. Standard Red Hat Enterprise Linux installations do not enable this hardware driver by default, substantially limiting exposure in typical enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.