CVE-2021-47232

What it actually does

Use-after-free in Linux kernel J1939 CAN implementation: skb dequeued from per-session queue without refcount increment, enabling concurrent access after free and resulting memory corruption or arbitrary code execution.

Why it matters to the business

Local attackers can crash systems or gain elevated privileges on Linux hosts using J1939, causing downtime or unauthorized control in automotive, industrial, or embedded environments.

How an attack unfolds

An attacker with local access triggers J1939 sessions and races concurrent CTS/frame operations to dequeue an skb without holding its reference, then reuses the freed memory for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing the referenced fix that increments skb refcount while the buffer remains in use on the J1939 session queue.

How to confirm the fix worked

Inspect kernel source for refcount increment prior to skb dequeue in j1939 code paths; verify with reproducer tools or kernel crash analysis showing resolved UAF conditions.

Typical attack path

1. Obtain local access on a Linux system with J1939 CAN support enabled
2. Initiate J1939 session and queue CAN frames
3. Trigger concurrent dequeue operations via CTS to cause use-after-free
4. Leverage freed skb memory for corruption or payload execution

How to detect it

Review kernel logs and dmesg for use-after-free warnings or oops mentioning j1939, skb, or CAN session queue operations; correlate with process activity involving CAN interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing J1939 interfaces
• Disable J1939 module if CAN functionality is not required
• Monitor kernel logs for j1939-related oops and panics
• Apply least-privilege access controls around CAN devices