CVE-2021-47520

What it actually does

Use-after-free in the pch_can_rx_normal path where skb (and its aliased can_frame) is dereferenced after netif_receive_skb may have freed it, enabling memory corruption or arbitrary code execution in kernel context.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or escalate privileges, leading to denial of service or full host compromise; high prevalence in embedded and automotive CAN deployments increases operational risk.

How an attack unfolds

An attacker with local access crafts and injects CAN frames that reach pch_can_rx_normal; the driver passes the skb to netif_receive_skb which can free it, then immediately dereferences the now-invalid can_frame alias, triggering the use-after-free.

How to fix it

Upgrade to a Linux kernel containing the upstream fix that reorders the can_frame access before the netif_receive_skb call; apply the patch or newer vendor kernel as soon as possible.

How to confirm the fix worked

Confirm the kernel source contains the reordered access (cf extraction before netif_receive_skb) or verify the running kernel version is newer than the vulnerable commit range; test with CAN traffic that exercises the receive path.

Typical attack path

1. Obtain local shell or user context on a system using the pch_can driver
2. Inject crafted CAN frames via the SocketCAN interface to exercise pch_can_rx_normal
3. Trigger the post-netif_receive_skb dereference of the freed skb memory
4. Leverage resulting memory corruption for privilege escalation or kernel panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or use-after-free warnings referencing pch_can_rx_normal or netif_receive_skb; correlate with CAN frame injection events from audit or system call logs.

What your security team should do

• Prioritize kernel updates on all systems exposing SocketCAN or using pch_can hardware
• Restrict local CAN interface access via capabilities and namespaces until patched
• Monitor for kernel oops or crashes in pch_can paths as indicators of attempted exploitation