CVE-2021-47459

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

It will trigger UAF for rx_kref of j1939_priv as following.

cpu0 cpu1

j1939_sk_bind(socket0, ndev0, ...)

j1939_netdev_start

j1939_sk_bind(socket1, ndev0, ...)

j1939_netdev_start

j1939_priv_set

j1939_priv_get_by_ndev_locked

j1939_jsk_add

.....

j1939_netdev_stop

kref_put_lock(&priv->rx_kref, ...)

kref_get(&priv->rx_kref, ...)

REFCOUNT_WARN("addition on 0;...")

====================================================

refcount_t: addition on 0; use-after-free.

WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0

RIP: 0010:refcount_warn_saturate+0x169/0x1e0

Call Trace:

j1939_netdev_start+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References