CVE-2021-47457

What it actually does

Missing result check on wait_event_interruptible() in isotp_sendmsg() allows an interrupted wait to leave the TX buffer with multiple concurrent accessors, enabling a later process to interfere with an in-progress transmission and trigger a warning in isotp_tx_timer_handler.

Why it matters to the business

Systems using CAN ISOTP sockets may experience kernel warnings, transmission corruption, or local denial of service when unprivileged processes interact with the protocol under interruptible conditions.

How an attack unfolds

An attacker with local access creates an ISOTP socket, initiates a send that blocks on wait_event_interruptible(), forces an interrupt, then performs a second send or timer action that collides with the first, resulting in multiple accessors to the TX buffer.

How to fix it

Apply the upstream fix that adds a result check for wait_event_interruptible() in isotp_sendmsg(); update to a kernel containing the resolution for CVE-2021-47457.

How to confirm the fix worked

Confirm the presence of the result check after wait_event_interruptible() in net/can/isotp.c; test with syzbot-style reproducers to ensure no multiple-accessor warnings occur.

Typical attack path

1. Obtain local unprivileged access on a Linux system with CAN ISOTP enabled
2. Create an ISOTP socket and call sendmsg to trigger the blocking wait
3. Interrupt the wait_event_interruptible call
4. Trigger a second access to the same TX buffer via another send or timer expiration
5. Observe kernel warning or transmission interference

How to detect it

Search kernel logs for warnings from isotp_tx_timer_handler and monitor for repeated ISOTP socket operations from the same process under load; review audit logs for unusual local CAN socket activity.

• isotp_tx_timer_handler
• WARNING: CPU:.*at net/can/isotp.c

What your security team should do

• Prioritize kernel updates on systems exposing CAN interfaces
• Disable CAN ISOTP module if not required
• Monitor for kernel warnings referencing isotp_tx_timer_handler