Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 May 2021 17:41:03 +0200
From: Oliver Hartkopp <>
To: Greg Kroah-Hartman <>
Cc:,,,,,, Norbert Slusarek <>,
 "David S. Miller" <>, Jakub Kicinski <>,
Subject: Re: Linux kernel: net/can/isotp: race condition leads to local
 privilege escalation

Hello Greg,

this patch ("can: isotp: prevent race between isotp_bind() and 
isotp_setsockopt()") has hit Linus' tree ~36h ago:

It has a CVE number and is potentially exploitable - but it was not in 
the latest batch of stable kernels about ~4h ago.

It was obviously not tagged properly for stable kernels but has a fixes-tag:

Fixes: 921ca574cd38 ("can: isotp: add SF_BROADCAST support for 
functional addressing")

which was introduced in 5.11

Thanks for taking care!


On 14.05.21 01:52, Norbert Slusarek wrote:
> As Salvatore already mentioned, the assigned CVE ID is CVE-2021-32606.
> The exploitation details are published in an article available on github
> via this link:
> <>
> Regards,
> Norbert Slusarek

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.