CVE-2023-52887: net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
In the Linux kernel, the following vulnerability has been resolved:
net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew
This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARNONONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939xtprxrts().
Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 & while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52887?
CVE-2023-52887 has been classified as a moderate severity vulnerability due to its impact on error handling of RTS messages.
How do I fix CVE-2023-52887?
To remediate CVE-2023-52887, update to the patched versions of the Linux kernel listed in the advisory.
What systems are affected by CVE-2023-52887?
CVE-2023-52887 specifically affects multiple versions of the Linux kernel, including 5.10.223-1, 5.10.226-1, 6.1.119-1, and others.
What does CVE-2023-52887 change in the Linux kernel?
CVE-2023-52887 enhances error handling for tightly received RTS messages in the networking code of the Linux kernel.
Can I check if my system is vulnerable to CVE-2023-52887?
Yes, you can determine your system's vulnerability to CVE-2023-52887 by checking the version of the Linux kernel currently installed.