Security readout for executives and security teams
Plain-English summary
CVE-2024-56651 is a Linux kernel flaw in the HI311x CAN driver. A local user could potentially trigger a use-after-free condition, which may allow system compromise or denial of service on affected systems. Risk is mainly for Linux devices that use this CAN driver, often in embedded or operational environments.
Executive priority
Treat this as high priority for Linux fleets that include CAN-connected devices or embedded systems. It is less urgent for general servers without the HI311x CAN driver, but affected operational devices should be patched through normal maintenance windows.
Technical view
The flaw is in hi3110_can_ist() in the Linux kernel CAN HI311x driver. Error count data was added to an skb after netif_rx(), but the skb may already have been freed or reused. The fix postpones netif_rx() for txerr and rxerr reporting paths.
Likely exposure
Exposure is limited to affected Linux kernels where the HI311x CAN driver is present and reachable. The CVSS vector is local with low privileges required, so this is not described by the sources as a remote network vulnerability.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. The CVSS score is 7.8 because successful exploitation could affect confidentiality, integrity, and availability, but evidence provided only supports local attack context.
Researcher notes
The core bug is skb lifetime misuse after netif_rx(). Source evidence identifies the resolution direction but does not provide public exploit evidence. Version data in the bundle is branch and commit oriented, so validation should rely on vendor kernel package mapping.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Check distribution or device vendor advisories for fixed package versions.
- Prioritize embedded, industrial, or operational systems using CAN interfaces.
- Backport the kernel fix if running an unsupported affected branch.
- Disable unused HI311x CAN support only after operational review.
Validation and detection
- Inventory Linux kernel versions across systems using CAN interfaces.
- Confirm whether the HI311x CAN driver is built, loaded, or required.
- Compare deployed kernels against vendor fixed versions or stable commits.
- Review distro advisories, including Debian LTS, for package status.
- Retest affected devices after kernel update or backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4ad77eb8f2e07bcfa0e28887d3c7dbb732d92cc1CVE reference, Linux
- https://git.kernel.org/stable/c/1128022009444faf49359bd406cd665b177cb643CVE reference, Linux
- https://git.kernel.org/stable/c/bc30b2fe8c54694f8ae08a5b8a5d174d16d93075CVE reference, Linux
- https://git.kernel.org/stable/c/9ad86d377ef4a19c75a9c639964879a5b25a433bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.