CVE-2024-56651

What it actually does

Potential use-after-free in hi311x CAN driver when error counts are written to an skb after netif_rx() returns, as the buffer may already be freed or reused.

Why it matters to the business

Kernel instability or code execution on systems using the hi311x CAN controller, risking crashes in industrial, automotive, or embedded Linux deployments and requiring urgent patching.

How an attack unfolds

An attacker with local access triggers CAN bus error conditions (txerr/rxerr) on the hi311x interface; the driver then accesses the skb after it may have been freed by netif_rx processing, enabling use-after-free exploitation.

How to fix it

Update the Linux kernel to include commit 3d7cb6b04c3f3115719235cc6866b10326de34cd or later; rebuild and deploy the patched kernel image on affected systems.

How to confirm the fix worked

Verify the presence of the fix by inspecting the hi3110_can_ist function in the hi311x driver source for the reordered netif_rx call, or confirm the running kernel contains the referenced commit.

Typical attack path

1. Obtain local access to a system with hi311x CAN hardware enabled
2. Induce CAN bus error states that cause txerr/rxerr reporting
3. Trigger the post-netif_rx error count write to trigger the use-after-free
4. Leverage the freed skb for memory corruption or arbitrary execution

How to detect it

Review kernel logs for oops/panic messages referencing hi311x or hi3110_can_ist; inspect crash dumps for skb use-after-free patterns in the CAN receive path.

What your security team should do

• Prioritize kernel upgrade on all systems exposing the hi311x CAN driver
• Monitor for kernel oops or crashes involving hi311x until patched
• Restrict local access and CAN interface usage where feasible until remediation