CVE-2023-52638: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: prevent deadlock by changing j1939sockslock to rwlock
The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report:
- j1939sockslock - activesessionlistlock - sksessionqueuelock
A reasonable fix is to change j1939sockslock to an rwlock, since in the rare situations where a write lock is required for the linked list that j1939sockslock is protecting, the code does not attempt to acquire any more locks. This would break the circular lock dependency, where, for example, the current thread already locks j1939sockslock and attempts to acquire sksessionqueuelock, and at the same time, another thread attempts to acquire j1939sockslock while holding sksessionqueuelock.
NOTE: This patch along does not fix the unregisternetdevice bug reported by Syzbot; instead, it solves a deadlock situation to prepare for one or more further patches to actually fix the Syzbot bug, which appears to be a reference counting problem within the j1939 codebase.
[mkl: remove unrelated newline change]
Other sources
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: prevent deadlock by changing j1939sockslock to rwlock
The Linux kernel CVE team has assigned CVE-2023-52638 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040334-CVE-2023-52638-26a6@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52638?
CVE-2023-52638 is classified as a medium severity vulnerability due to the potential for deadlock situations.
How do I fix CVE-2023-52638?
To fix CVE-2023-52638, update your Linux kernel to version 5.15.149, 6.1.79, 6.6.18, 6.7.6, or 6.8.
Which systems are affected by CVE-2023-52638?
CVE-2023-52638 affects multiple Linux kernel versions across varying distributions, including specific versions from Red Hat and Debian.
What is the nature of the vulnerability described in CVE-2023-52638?
CVE-2023-52638 is a deadlock vulnerability caused by racing locks within the j1939 subsystem of the Linux kernel.
Is CVE-2023-52638 under active exploitation?
As of now, there is no public evidence indicating that CVE-2023-52638 is actively exploited in the wild.