CVE-2023-52637: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: Fix UAF in j1939skmatchfilter during setsockopt(SOJ1939FILTER)
Lock jsk->sk to prevent UAF when setsockopt(..., SOJ1939FILTER, ...) modifies jsk->filters while receiving packets.
Following trace was seen on affected system: ================================================================== BUG: KASAN: slab-use-after-free in j1939skrecvmatchone+0x1af/0x2d0 [canj1939] Read of size 4 at addr ffff888012144014 by task j1939/350
CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: printreport+0xd3/0x620 ? kasancompletemodereportinfo+0x7d/0x200 ? j1939skrecvmatchone+0x1af/0x2d0 [canj1939] kasanreport+0xc2/0x100 ? j1939skrecvmatchone+0x1af/0x2d0 [canj1939] asanload4+0x84/0xb0 j1939skrecvmatchone+0x1af/0x2d0 [canj1939] j1939skrecv+0x20b/0x320 [canj1939] ? kasancheckwrite+0x18/0x20 ? pfxj1939skrecv+0x10/0x10 [canj1939] ? j1939simplerecv+0x69/0x280 [canj1939] ? j1939acrecv+0x5e/0x310 [canj1939] j1939canrecv+0x43f/0x580 [canj1939] ? pfxj1939canrecv+0x10/0x10 [canj1939] ? rawrcv+0x42/0x3c0 [canraw] ? pfxj1939canrecv+0x10/0x10 [canj1939] canrcvfilter+0x11f/0x350 [can] canreceive+0x12f/0x190 [can] ? pfxcanrcv+0x10/0x10 [can] canrcv+0xdd/0x130 [can] ? pfxcanrcv+0x10/0x10 [can] netifreceiveskbonecore+0x13d/0x150 ? pfxnetifreceiveskbonecore+0x10/0x10 ? kasancheckwrite+0x18/0x20 ? rawspinlockirq+0x8c/0xe0 netifreceiveskb+0x23/0xb0 processbacklog+0x107/0x260 napipoll+0x69/0x310 netrxaction+0x2a1/0x580 ? pfxnetrxaction+0x10/0x10 ? pfxrawspinlock+0x10/0x10 ? handleirqevent+0x7d/0xa0 dosoftirq+0xf3/0x3f8 dosoftirq+0x53/0x80 </IRQ> <TASK> localbhenableip+0x6e/0x70 netifrx+0x16b/0x180 cansend+0x32b/0x520 [can] ? pfxcansend+0x10/0x10 [can] ? checkobjectsize+0x299/0x410 rawsendmsg+0x572/0x6d0 [canraw] ? pfxrawsendmsg+0x10/0x10 [canraw] ? apparmorsocketsendmsg+0x2f/0x40 ? pfxrawsendmsg+0x10/0x10 [canraw] socksendmsg+0xef/0x100 sockwriteiter+0x162/0x220 ? pfxsockwriteiter+0x10/0x10 ? rtnlunlock+0x47/0x80 ? securityfilepermission+0x54/0x320 vfswrite+0x6ba/0x750 ? pfxvfswrite+0x10/0x10 ? fgetlight+0x1ca/0x1f0 ? rcureadunlock+0x5b/0x280 ksyswrite+0x143/0x170 ? pfxksyswrite+0x10/0x10 ? kasancheckread+0x15/0x20 ? fpregsassertstateconsistent+0x62/0x70 x64syswrite+0x47/0x60 dosyscall64+0x60/0x90 ? dosyscall64+0x6d/0x90 ? irqentryexit+0x3f/0x50 ? excpagefault+0x79/0xf0 entrySYSCALL64afterhwframe+0x6e/0xd8
Allocated by task 348: kasansavestack+0x2a/0x50 kasansettrack+0x29/0x40 kasansaveallocinfo+0x1f/0x30 kasankmalloc+0xb5/0xc0 kmallocnodetrackcaller+0x67/0x160 j1939sksetsockopt+0x284/0x450 [canj1939] syssetsockopt+0x15c/0x2f0 x64syssetsockopt+0x6b/0x80 dosyscall64+0x60/0x90 entrySYSCALL64afterhwframe+0x6e/0xd8
Freed by task 349: kasansavestack+0x2a/0x50 kasansettrack+0x29/0x40 kasansavefreeinfo+0x2f/0x50 kasanslabfree+0x12e/0x1c0 kmemcachefree+0x1b9/0x380 kfree+0x7a/0x120 j1939sksetsockopt+0x3b2/0x450 [canj1939] syssetsockopt+0x15c/0x2f0 x64syssetsockopt+0x6b/0x80 dosyscall64+0x60/0x90 entrySYSCALL64afterhwframe+0x6e/0xd8
Other sources
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: Fix UAF in j1939skmatchfilter during setsockopt(SOJ1939FILTER)
The Linux kernel CVE team has assigned CVE-2023-52637 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040332-CVE-2023-52637-5e37@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.269 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.210 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.149 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.79 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.18 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2023-52637 - Configuration
In the j1939 implementation, lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while packets are receiving.
Linux kernel can/j1939 (SO_J1939_FILTER) jsk->sk locking during setsockopt(SO_J1939_FILTER) = Lock jsk->sk while setsockopt modifies jsk->filters
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52637?
CVE-2023-52637 is classified as a medium severity vulnerability due to the potential for a use-after-free condition leading to possible exploitation.
How do I fix CVE-2023-52637?
To resolve CVE-2023-52637, upgrade your Linux kernel to one of the fixed versions: 5.4.269, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, or 6.8.
Which Linux kernel versions are affected by CVE-2023-52637?
CVE-2023-52637 affects Linux kernel versions prior to 5.4.269, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8.
What is the impact of CVE-2023-52637?
The impact of CVE-2023-52637 includes potential arbitrary code execution due to a use-after-free vulnerability in the Linux kernel's handling of J1939 socket options.
Is there a workaround for CVE-2023-52637?
There is no known workaround for CVE-2023-52637, and it is recommended to apply the available patches to secure your system.