Security readout for executives and security teams
Plain-English summary
A Linux kernel error can leave behind a pointer to freed memory while creating a CAN socket. A local, low-privileged attacker may be able to trigger later memory misuse, potentially compromising confidentiality, integrity, or availability. The supplied CVSS score is 7.8 (High).
Executive priority
Treat as an expedited kernel-maintenance issue, especially on multi-user systems or hosts running untrusted local workloads. It is high severity but not evidenced as remotely reachable or actively exploited. Confirm exposure promptly, deploy supported updates through normal change controls, and verify the corrected kernel is active.
Technical view
In can_create(), an error path frees the allocated socket structure after sock_init_data() has attached it to the caller-provided socket. The remaining dangling sk pointer can later cause a use-after-free (CWE-416). The supplied vector indicates local access, low complexity, low privileges, no user interaction, and potentially high impact.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and presenting the vulnerable AF_CAN socket-creation path to local users or processes. The supplied version data is ambiguous and should not be used alone for fleet decisions; verify each distribution kernel against vendor advisories and backported fixes.
Exploitation context
The supplied record does not list this CVE in CISA KEV and provides no evidence of active exploitation or a public exploit. CVSS describes a local, low-privileged attack scenario. The sources do not establish practical exploit reliability or whether additional system conditions are required.
Researcher notes
The core defect is lifetime inconsistency between sock->sk and the freed sk object on can_create() failure. Analysis should focus on affected vendor backports, error-path reachability, and subsequent dereferences. The bundle confirms remediation through upstream stable commits, but it does not document trigger prerequisites, exploitation reliability, or observed attacks.
Mitigation direction
- Install the distribution-supported kernel update that incorporates the applicable upstream stable fix.
- Reboot into the updated kernel, following the distribution's operational guidance.
- Prioritize systems allowing untrusted or numerous local users and workloads.
- Check Linux and distribution advisories for backport status before relying on version numbers alone.
Validation and detection
- Record the running kernel release and distribution package revision on every Linux asset.
- Map package revisions to vendor advisories or the cited upstream stable fixes.
- Confirm the updated kernel is running after reboot, not merely installed.
- Review local access exposure and whether AF_CAN functionality is available to untrusted processes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56603 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425cCVE reference, Linux
- https://git.kernel.org/stable/c/ce39b5576785bb3e66591145aad03d66bc3e778dCVE reference, Linux
- https://git.kernel.org/stable/c/1fe625f12d090d69f3f084990c7e4c1ff94bfe5fCVE reference, Linux
- https://git.kernel.org/stable/c/5947c9ac08f0771ea8ed64186b0d52e9029cb6c0CVE reference, Linux
- https://git.kernel.org/stable/c/db207d19adbac96058685f6257720906ad41d215CVE reference, Linux
- https://git.kernel.org/stable/c/8df832e6b945e1ba61467d7f1c9305e314ae92feCVE reference, Linux
- https://git.kernel.org/stable/c/811a7ca7320c062e15d0f5b171fe6ad8592d1434CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.