CVE-2024-56603

What it actually does

In can_create(), an error path frees the sk object after sock_init_data() has attached it, leaving a dangling pointer in the sock that can trigger use-after-free on later access.

Why it matters to the business

Linux kernel systems may experience crashes, memory corruption, or potential privilege escalation, disrupting network services and requiring urgent patching across server and embedded fleets.

How an attack unfolds

An attacker crafts input that forces an error return from can_create() on the CAN protocol socket creation path, freeing the sk while it remains referenced, then reuses the dangling pointer to achieve arbitrary kernel code execution or information leak.

How to fix it

Update the Linux kernel to the commit 884ae8bcee749be43a071d6ed2d89058dbd2425c or later stable releases that contain the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 884ae8bcee749be43a071d6ed2d89058dbd2425c via git log or uname output against the fixed tree; test CAN socket creation under error injection to confirm no dangling pointer remains.

Typical attack path

1. Create a CAN socket via socket(AF_CAN, ...)
2. Trigger an error condition inside can_create() before full initialization completes
3. Force the error path that calls sock_release without clearing the attached sk pointer
4. Reuse the freed sk object through subsequent socket operations or concurrent threads
5. Leverage the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for CAN socket allocation failures followed by use-after-free warnings or oops; inspect auditd or eBPF traces around socket creation for anomalous CAN protocol activity; correlate with threat actor campaigns targeting Linux kernel flaws.

What your security team should do

• Apply the kernel patch containing commit 884ae8bcee749be43a071d6ed2d89058dbd2425c immediately on all exposed systems
• Prioritize reboot of production CAN-enabled hosts and gateways
• Monitor for related kernel stability issues post-upgrade
• Review downstream dependent packages and rebuild custom kernels if necessary