CVE-2024-56645

What it actually does

The vulnerability is a reference count underflow in j1939_session_new() that fails to perform an initial skb_get() matching the extra get performed by j1939_session_skb_queue(), allowing a use-after-free when the socket buffer is subsequently released.

Why it matters to the business

Attackers who can trigger CAN/J1939 session creation on affected systems may achieve kernel memory corruption, potentially leading to system crashes, privilege escalation, or full host compromise in environments using the affected kernel code paths.

How an attack unfolds

An attacker with local access or the ability to inject J1939 traffic crafts a sequence of session creation operations that causes the skb refcount to drop below zero; subsequent use of the freed skb results in a use-after-free condition that can be leveraged for arbitrary kernel read/write or code execution.

How to fix it

Update to a kernel containing the referenced fix; for the listed lxc packages on Ubuntu 14.04 LTS apply version 1.0.8-0ubuntu0.4 or later. Reboot systems after kernel updates and verify the running kernel version.

How to confirm the fix worked

Confirm the installed kernel or lxc package reports the fixed version string, then exercise J1939 session creation paths under load while monitoring for refcount warnings or crashes; review kernel changelog entries mentioning j1939_session_new skb reference counting.

Typical attack path

1. Obtain local access or network position to send J1939 frames
2. Trigger repeated j1939_session_new() calls without corresponding queue operations to induce refcount underflow
3. Force reuse of the now-freed skb structure
4. Exploit the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for refcount underflow warnings or use-after-free crashes involving sk_buff and j1939 structures; inspect auditd or syslog entries showing unusual CAN socket activity around the time of any stability issues.

What your security team should do

• Prioritize patching all systems exposing CAN/J1939 interfaces within the next maintenance window
• Restrict unprivileged access to raw CAN sockets via AppArmor or seccomp profiles until patches are applied
• Monitor for kernel oops or slab corruption events related to sk_buff objects
• Audit any containers or virtual machines running older Ubuntu 14.04 LTS kernels for the listed lxc package